{"action":"Upgrade mediawiki/cargo to 3.8.3 or later.","affected":[{"fixed":"3.8.3","introduced":"0"}],"component":"mediawiki/cargo","cve_ids":["CVE-2025-62671"],"ecosystem":"Packagist","epss":0.0051,"exploited":false,"fixed_versions":["3.8.3"],"ghsa_id":"GHSA-gr6v-3pmp-996p","id":"tcs_01M5KF328BMP780HY9KJF44AMG","modified_at":"2025-10-20T18:27:46.506909Z","published_at":"2025-10-18T06:30:26Z","references":["https://osv.dev/vulnerability/GHSA-gr6v-3pmp-996p","https://nvd.nist.gov/vuln/detail/CVE-2025-62671","https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e50915626c0d9a7b222dabc94ddfcb516caf557d","https://gerrit.wikimedia.org/r/1179707","https://github.com/wikimedia/mediawiki-extensions-Cargo","https://phabricator.wikimedia.org/T402147"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-gr6v-3pmp-996p","url":"https://osv.dev/vulnerability/GHSA-gr6v-3pmp-996p"},{"source":"nvd","source_id":"CVE-2025-62671","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62671"}],"summary":"Cargo Mediawiki Extension vulnerable to Cross-site Scripting"}