{"id":"CVE-2025-62671","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-62671","summary":"Cargo Mediawiki Extension vulnerable to Cross-site Scripting","details":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension befor 3.8.3.","published":"2025-10-18T06:30:26Z","modified":"2025-10-20T18:27:46.506909Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"mediawiki/cargo","fixedVersion":"3.8.3"}],"fix":{"url":"https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e50915626c0d9a7b222dabc94ddfcb516caf557d","label":"wikimedia/mediawiki-extensions-Cargo@e509156"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62671"},{"type":"WEB","url":"https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e50915626c0d9a7b222dabc94ddfcb516caf557d"},{"type":"WEB","url":"https://gerrit.wikimedia.org/r/1179707"},{"type":"PACKAGE","url":"https://github.com/wikimedia/mediawiki-extensions-Cargo"},{"type":"WEB","url":"https://phabricator.wikimedia.org/T402147"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-20T18:27:46.506909Z"}}