CVE-2024-47847 Various XSSes found in Cargo

What is CVE-2024-47847?

CVE-2024-47847 is a medium-severity cross-site scripting vulnerability in The Wikimedia Foundation Mediawiki - Cargo, published on 5 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Weakness: CWE-79

Which versions are affected by CVE-2024-47847?

2 open source packages ship an affected version, including mediawiki/cargo. It affects 1 product.

Products include Mediawiki Cargo.

How do I fix CVE-2024-47847?

Upgrade mediawiki/cargo to 3.6.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-47847 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47847 exists.

Other vulnerabilities in The Wikimedia Foundation Mediawiki - Cargo

• CVE-2024-47849 Backticks can allow the usage of not-allowed SQL functions High 8.8
• CVE-2026-14363 Cargo Extension: SQLi in Special:Drilldown Medium 6.9
• CVE-2026-58519 Stored XSS through Cargo's map format Medium 6.9
• CVE-2026-58521 SQLi in Cargo extension via year range filter Medium 6.9
• CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jqvm-9xm2-gc38.