CVE-2025-62671: Cargo Mediawiki Extension vulnerable to Cross-site Scripting

October 18, 2025 (updated November 10, 2025)

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension befor 3.8.3.

References

gerrit.wikimedia.org/r/1179707
github.com/advisories/GHSA-gr6v-3pmp-996p
github.com/wikimedia/mediawiki-extensions-Cargo
github.com/wikimedia/mediawiki-extensions-Cargo/commit/e50915626c0d9a7b222dabc94ddfcb516caf557d
nvd.nist.gov/vuln/detail/CVE-2025-62671
phabricator.wikimedia.org/T402147

Code Behaviors & Features

Detect and mitigate CVE-2025-62671 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →