{"action":"Upgrade mediawiki/cargo to 1.35.14 or later.","affected":[{"fixed":"1.35.14","introduced":"0"},{"fixed":"1.39.6","introduced":"1.36.0"},{"fixed":"1.40.2","introduced":"1.40.0"}],"component":"mediawiki/cargo","cve_ids":["CVE-2024-23173"],"ecosystem":"Packagist","epss":0.00424,"exploited":false,"fixed_versions":["1.35.14","1.39.6","1.40.2"],"ghsa_id":"GHSA-rhpm-63w5-79rg","id":"tcs_01M5KF8A9Y90MFD4KWWNV8XPEK","modified_at":"2025-09-29T15:57:17.177294Z","published_at":"2024-01-12T06:30:16Z","references":["https://osv.dev/vulnerability/GHSA-rhpm-63w5-79rg","https://nvd.nist.gov/vuln/detail/CVE-2024-23173","https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e4f0b7fb11da0e4b18f2c416101965e417ba3bd2","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214","https://github.com/wikimedia/mediawiki-extensions-Cargo","https://phabricator.wikimedia.org/T348687"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-rhpm-63w5-79rg","url":"https://osv.dev/vulnerability/GHSA-rhpm-63w5-79rg"}],"summary":"MediaWiki Cargo Extension Cross-site Scripting vulnerability"}