Through storing arbitrary HTML to a Cargo table's list field, it is possible to achieve a stored XSS on Special:CargoTables and action=pagevalues.

Reproduction steps

1. Create Template:XSS with the following contents:

{{#cargo_declare:_table=ListXss
|Items=List (,) of String
}}
{{#cargo_store:_table=ListXss
|Items=<script>alert('xss')</script>
}}

2. Create the table for Template:XSS
3. Null-edit Template:XSS to insert the row
4. Go to Special:CargoTables/XSS or Template:XSS?action=pagevalues
5. An alert box is displayed on page load.

Cause

In CargoQueryDisplayer, combined list field values are entity-decoded in case the item delimiter could be affected. However, the individual items that are being formatted do not get encoded, and non-Wikitext field types do not run through the wikitext parser.

Additional information

Cargo 3.8.6 (e89d34e)