Critical Eval Injection Flaw in XWiki Rendering XML Component Allows RCE via HTML Macro Escaping Bypass

What Happened

A GitHub Security Advisory (GHSA-26vp-8gxg-v4pg) discloses an eval injection vulnerability in org.xwiki.rendering:xwiki-rendering-xml, tracked as CVE-2025-53837 with a reported CVSS score of 9.9. According to the advisory, any user able to edit their own user profile or other documents can execute arbitrary script macros — including Groovy and Python — leading to remote code execution with full read/write access to wiki contents. The root cause is that rendering output is embedded inside HTML macros without proper escaping, allowing an attacker to close the HTML macro early and inject script macros that execute with programming rights.

The advisory includes a proof-of-concept payload that plants a crafted XWiki.UIExtensionClass object and triggers it via a specific extension point and page view, demonstrating that injected Groovy code executes server-side rather than being rendered as inert text. The escaping gap reportedly existed since XWiki syntax version 2 and was confirmed exploitable as far back as XWiki 3.3 Milestone 1, with additional exploitable extension points introduced later (XWiki 8.3 Milestone 1). The maintainers state it has been patched in XWiki 14.10.2 and 15.0 RC1.

Why It Matters for Defenders

This affects any organization running self-hosted or managed XWiki instances that have not upgraded to 14.10.2 / 15.0 RC1 or later. Given the low privilege bar described in the advisory — a user only needs the ability to edit their own profile or a document — and the outcome (unrestricted read/write access to wiki content via arbitrary script execution), this is a high-impact issue for any deployment where user self-service editing is enabled, including semi-trusted internal wikis and multi-tenant setups. The public PoC and 9.9 CVSS score mean exploitation is straightforward to reproduce once an instance is identified as vulnerable.

What Defenders Should Watch For

• Inventory and confirm the patched version (14.10.2 / 15.0 RC1 or later) is deployed on all XWiki instances, including any embedded or vendored copies of xwiki-rendering-xml.
• Review recent edits to user profile documents and any documents using XWiki.UIExtensionClass objects for unusual extension point IDs, unexpected HTML macro content, or attempts to nest {{html}}/{{groovy}}/{{python}} macros with obfuscated or escaped-character syntax.
• Hunt for anomalous outbound activity or file system changes originating from the XWiki application process, since successful exploitation grants programming rights equivalent to server-side script execution.
• Audit access logs for requests to view pages combined with unusual query parameters (e.g., sheet/xpage combinations) that could indicate probing of extension-point rendering behavior.
• As an interim mitigation if patching is delayed, restrict document/profile editing permissions to trusted users and consider disabling or tightly scoping custom extension points until upgraded.

Developing Intel

This item is based on a single GitHub Security Advisory published today and reflects the maintainers' own description of the issue, its history, and available patches. Details around real-world exploitation, scope of affected deployments, and any secondary advisories should be treated as preliminary. For full technical details and the authoritative fix guidance, see the original advisory: GHSA-26vp-8gxg-v4pg.