Cargo’s Exhibit format copied query field aliases into its rendered lens as raw HTML. An editor could add a Cargo query to a page with a crafted field alias; a visitor who viewed that page would receive the alias as markup in the wiki origin.
Technical details
Cargo accepted aliases containing characters used by an HTML event handler. In the Exhibit renderer, it concatenated each alias into table rows, headings, and data-ex-* attributes without escaping it or building those elements through the HTML helper.
A crafted alias containing an image element created an event-bearing element. The attacker needed permission to edit a page rendered for other users and access to an Exhibit query with at least two fields. Cargo versions through 3.9.4 were affected.
Reproduction
- On a wiki with Cargo and the Exhibit format enabled, choose a table with at least two fields.
- Add a Cargo query to a page and put an image element with a harmless error-handler marker in the second field’s alias.
- Open the page in a browser.
- The Exhibit lens contains the image element, and its handler sets the marker.
Impact
This was stored cross-site scripting. JavaScript ran in the wiki origin for users who viewed the page containing the query, including privileged users.
References
Cargo's Exhibit format copied query field aliases into its rendered lens as raw HTML. An editor could add a Cargo query to a page with a crafted field alias; a visitor who viewed that page would receive the alias as markup in the wiki origin.
## Technical details
Cargo accepted aliases containing characters used by an HTML event handler. In the Exhibit renderer, it concatenated each alias into table rows, headings, and `data-ex-*` attributes without escaping it or building those elements through the HTML helper.
A crafted alias containing an image element created an event-bearing element. The attacker needed permission to edit a page rendered for other users and access to an Exhibit query with at least two fields. Cargo versions through 3.9.4 were affected.
## Reproduction
1. On a wiki with Cargo and the Exhibit format enabled, choose a table with at least two fields.
2. Add a Cargo query to a page and put an image element with a harmless error-handler marker in the second field's alias.
3. Open the page in a browser.
4. The Exhibit lens contains the image element, and its handler sets the marker.
## Impact
This was stored cross-site scripting. JavaScript ran in the wiki origin for users who viewed the page containing the query, including privileged users.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96878)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-96878)
- [Cargo fix on Gerrit](https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328627)
- [Research index](/about/)
BomboBombone.exe