Skip to content
CVE IDCVE-2025-53837GitHub advisory IDGHSA-26vp-8gxg-v4pg

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

CVE-2025-53837 (GitHub advisory GHSA-26vp-8gxg-v4pg) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.9, classed as Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95), in org.xwiki.rendering:xwiki-rendering-xml (Maven). Affected versions: < 14.10.2. It is fixed in 14.10.2.

Critical9.9Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

9.9CriticalCVSS 3.1
CVE ID
CVE-2025-53837
GHSA ID
GHSA-26vp-8gxg-v4pg
EPSS
0.64%higher than 49% of CVEs
Weakness (CWE)
  • CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • Maven
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Impact

Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights.

This can be demonstrated by adding an object of type XWiki.UIExtensionClass to a document with content {{html wiki="true"}}~{~{~/~h~t~m~l~}~}~ ~{~{~c~a~c~h~e~}~}~{~{~g~r~o~o~v~y~}~}~p~r~i~n~t~l~n~(~1~)~{~{~/~g~r~o~o~v~y~}~}~{~{~/~c~a~c~h~e~}~}{{/html}}, extension point id org.xwiki.platform.html.head, extension id org.xwiki.myuser.test and extension scope "current user". When opening <xwiki-server>/xwiki/bin/view/Main/?sheet=CKEditor.ContentSheet&xpage=plain where <xwiki-server> is the URL of the XWiki installation, the output should start with {{/html}} {{cache}}{{groovy}}println(1){{/groovy}}{{/cache}} and not with  1</p>.

This escaping was always missing at least in XWiki syntax version 2, it is definitely exploitable in XWiki 3.3 Milestone 1 via the user profile (not through extension points), though this has also been fixed by a separate patch, see the advisory. Exploitable extension points include org.xwiki.platform.search.ui.docdoesnotexist which has been added in XWiki 8.3 Milestone 1.

Patches

This has been patched in XWiki 14.10.2 and 15.0 RC1 by making sure that rendering output cannot close the surrounding HTML macro.

Workarounds

It is in principle possible to add escaping to all places where rendering output is used in wiki documents but at the moment there is no list of them.

For more information

If you have any questions or comments about this advisory:

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Critical9.9Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
Low
User Interaction UI
None
Scope S
Changed
Confidentiality C
High
Integrity I
High
Availability A
High

Affected packages

Source: OSV (GitHub advisory)

  • org.xwiki.rendering:xwiki-rendering-xml
    Maven
    pkg:maven/org.xwiki.rendering/xwiki-rendering-xml
    Affected versions
    < 14.10.2
    Fixed in
    14.10.2
    Show 353 listed versions
    • 10.0
    • 10.1
    • 10.1-rc-1
    • 10.10
    • 10.10-rc-1
    • 10.11
    • 10.11-rc-1
    • 10.11.1
    • 10.11.10
    • 10.11.11
    • 10.11.2
    • 10.11.3

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 14.10.2 or later.

Patch commits

  • 92bc809Patch commitgithub.com/xwiki/xwiki-rendering

    XRENDERING-693: XHTML printer does not protect against closing HTML macro in raw output

    +101 −2 across 4 files

    • xwiki-rendering-macros/xwiki-rendering-macro-html/src/test/resources/macrohtml20.test+26 −0
    • xwiki-rendering-xml/pom.xml+8 −1
    • xwiki-rendering-xml/src/main/java/org/xwiki/rendering/renderer/printer/XHTMLWikiPrinter.java+18 −1
    • xwiki-rendering-xml/src/test/java/org/xwiki/rendering/renderer/printer/XHTMLWikiPrinterTest.java+49 −0

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 293cc72Release commit14.10.2github.com/xwiki/xwiki-rendering
  • 9ab0c60Release commit14.10.2github.com/xwiki/xwiki-rendering

Vulnerability intelligence

References

Questions about CVE-2025-53837

What is the GHSA ID for CVE-2025-53837?
GitHub tracks CVE-2025-53837 as GHSA-26vp-8gxg-v4pg.
What is the CVSS score of CVE-2025-53837?
CVE-2025-53837 has a CVSS 3.1 base score of 9.9 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Which versions are affected by CVE-2025-53837?
org.xwiki.rendering:xwiki-rendering-xml (Maven): < 14.10.2.
How do I fix CVE-2025-53837?
Upgrade to 14.10.2 or later. The fix is in commit 92bc809.
What is the Package URL (PURL) for CVE-2025-53837?
The affected package's PURL is pkg:maven/org.xwiki.rendering/xwiki-rendering-xml.
Is CVE-2025-53837 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-53837. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 13:30 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.