# CVE-2025-53837: org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

> CVE-2025-53837 (GitHub advisory GHSA-26vp-8gxg-v4pg) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.9, classed as Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95), in org.xwiki.rendering:xwiki-rendering-xml (Maven). Affected versions: < 14.10.2. It is fixed in 14.10.2.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-53837

| Field | Value |
| --- | --- |
| CVE | CVE-2025-53837 |
| GHSA | GHSA-26vp-8gxg-v4pg |
| Severity | Critical |
| CVSS 3.1 | 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
| EPSS | 0.64% (higher than 49% of CVEs) |
| CISA KEV | Not listed |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

##### Impact
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights.

This can be demonstrated by adding an object of type `XWiki.UIExtensionClass` to a document with content `{{html wiki="true"}}~{~{~/~h~t~m~l~}~}~ ~{~{~c~a~c~h~e~}~}~{~{~g~r~o~o~v~y~}~}~p~r~i~n~t~l~n~(~1~)~{~{~/~g~r~o~o~v~y~}~}~{~{~/~c~a~c~h~e~}~}{{/html}}`, extension point id `org.xwiki.platform.html.head`, extension id `org.xwiki.myuser.test` and extension scope "current user". When opening `<xwiki-server>/xwiki/bin/view/Main/?sheet=CKEditor.ContentSheet&xpage=plain` where `<xwiki-server>` is the URL of the XWiki installation, the output should start with `{{/html}} {{cache}}{{groovy}}println(1){{/groovy}}{{/cache}}` and not with ` 1</p>`.

This escaping was always missing at least in XWiki syntax version 2, it is definitely exploitable in XWiki 3.3 Milestone 1 via the user profile (not through extension points), though this has also been fixed by a separate patch, see the [advisory](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x764-ff8r-9hpx). Exploitable extension points include [`org.xwiki.platform.search.ui.docdoesnotexist`](https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/ExtensionPoint/Suggestions%20for%20Document%20Does%20Not%20Exist/) which has been added in XWiki 8.3 Milestone 1.

##### Patches
This has been patched in XWiki 14.10.2 and 15.0 RC1 by making sure that rendering output cannot close the surrounding HTML macro.

##### Workarounds
It is in principle possible to add escaping to all places where rendering output is used in wiki documents but at the moment there is no list of them.

##### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.xwiki.rendering:xwiki-rendering-xml | Maven | `pkg:maven/org.xwiki.rendering/xwiki-rendering-xml` | < 14.10.2 | 14.10.2 |

## Fix commits

- Patch: https://github.com/xwiki/xwiki-rendering/commit/92bc8095ed3acce15ab200c8525e1623b4898be5
- Release: https://github.com/xwiki/xwiki-rendering/commit/293cc725fb9763849233c2473c57a9986568906c (14.10.2)
- Release: https://github.com/xwiki/xwiki-rendering/commit/9ab0c606476a134fbf6c8257273aff54209e3faf (14.10.2)

## Questions

**What is the GHSA ID for CVE-2025-53837?**

GitHub tracks CVE-2025-53837 as GHSA-26vp-8gxg-v4pg.

**What is the CVSS score of CVE-2025-53837?**

CVE-2025-53837 has a CVSS 3.1 base score of 9.9 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

**Which versions are affected by CVE-2025-53837?**

org.xwiki.rendering:xwiki-rendering-xml (Maven): < 14.10.2.

**How do I fix CVE-2025-53837?**

Upgrade to 14.10.2 or later. The fix is in commit 92bc809.

**What is the Package URL (PURL) for CVE-2025-53837?**

The affected package's PURL is pkg:maven/org.xwiki.rendering/xwiki-rendering-xml.

**Is CVE-2025-53837 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-53837. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49% of CVEs.

## References

- https://github.com/xwiki/xwiki-rendering/commit/92bc8095ed3acce15ab200c8525e1623b4898be5 (fix)
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-26vp-8gxg-v4pg (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53837.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2025-53837 (advisory)
- https://github.com/advisories/GHSA-26vp-8gxg-v4pg (advisory)
- https://github.com/xwiki/xwiki-rendering (package)
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-14.10.2
- https://github.com/xwiki/xwiki-rendering/releases/tag/xwiki-rendering-15.0-rc-1
- https://jira.xwiki.org/browse/XRENDERING-693
- https://jira.xwiki.org/browse/XWIKI-20313
- https://jira.xwiki.org/browse/XWIKI-20327

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-53837), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.