{"id":"CVE-2025-53835","summary":"XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax","details":"XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.","aliases":["GHSA-w3wh-g4m9-783p"],"modified":"2026-08-12T15:14:00.087264Z","published":"2025-07-14T23:00:35.577Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79","CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53835.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XRENDERING-660"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53835.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53835"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"6c03713c852a1fe73466c6001f0c70b03637a577"},{"fixed":"719ede2f8510fa69498761659de8d65eec5817db"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.4.5"},{"fixed":"14.10"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"7624af4939a46405cdfb3ad53e3bef7fc31b615d"},{"fixed":"c524887d154ff8f6df9651e36b904e234bf5a6ef"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.4.5"},{"fixed":"14.10"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-rendering","events":[{"introduced":"f4cbc74736522adb1ab4f0e5e6e108a302a993aa"},{"fixed":"a4ca31f99f524b9456c64150d6f375984aa81ea7"}],"database_specific":{"extracted_events":[{"introduced":"5.4.5"},{"fixed":"14.10"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53835.json","vanir_signatures_modified":"2026-08-12T15:14:00Z","vanir_signatures":[{"id":"CVE-2025-53835-023c68fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java","function":"XWikiReferenceTagHandler"},"deprecated":false,"digest":{"length":88,"function_hash":"189082468535516669982665348719894321556"}},{"digest":{"line_hashes":["198013157354009262904043909990988332653","255967728227037812884506606910282037788","111880295937277975117310539791026637612","299664359688471520661180973433711780746","170222426215186596783360611650025296118","148176601046084096919035416738703039193","297302385880043665963054104079664448644","55541355812333144103595681787316195819","144358829556288497657705011771214937861","284879517638933754486846828618910647811","278274653455863128907926880094729347996","89811086831095339917139008399801952677","121081023559973028021230400960753190694","126796942043548825188176555120394474220","121602170183701992524696815932905978658","9073636036831059636488847810150742637","193233962265273194937252990279941607225","322443853582538603584824793662844479256","239980935880466834424768958493831989456","155302226198900246552053876990926913237"],"threshold":0.9},"id":"CVE-2025-53835-077a9c2b","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java"},"deprecated":false},{"deprecated":false,"digest":{"length":705,"function_hash":"219022125095746337381869594531155194613"},"id":"CVE-2025-53835-15572632","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java","function":"end"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java","function":"XWikiWikiReference"},"deprecated":false,"digest":{"function_hash":"18241624895036448727015291908870603908","length":165},"id":"CVE-2025-53835-20e85c84"},{"digest":{"function_hash":"295063003632489478147860261147414406216","length":447},"id":"CVE-2025-53835-37a7dc9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XHTMLXWikiGeneratorListener.java","function":"onReference"},"deprecated":false},{"target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml5/src/main/java/org/xwiki/rendering/internal/parser/xhtml5/XHTML5Parser.java","function":"createWikiModelParser"},"deprecated":false,"digest":{"function_hash":"252132106396726785239700640019065275224","length":1103},"id":"CVE-2025-53835-3def8f52","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7"},{"deprecated":false,"digest":{"line_hashes":["244579708665859518725806772246227140959","94906987664196671141336078981037802742","231891248392324256214930287481300648192","327832489969432250604053709439303463382","293314616600054940024984884307616456636","260312162472155426875194215072860165821","94392039017049511559779804138992497022","316605763741727863690577195141229145482","263203334618110576452664385663949332890","300101566511181899714375189446771948323","57827792390163316713279241546885713577","151468965497157078124789087976672972599","66815211660678809529307001951600458546","332287135875228037325838417223227910056","229478906880294237454536518368022959765","143129557437173922569570271143083766072","66343113519888662585879500580292340811","315478245091188287162932882786793983434","175254954682694711583259755637204773968","122922422973731471983117518311731080264","226173455439788684114158151483339038495","134455227534881967461417227673819532854","334679339227538002082880531377779452632","229152247639381757667321774053254839996","85080404828463597898520435701570283879","70888513304979557321928436259703842884","317681612570223219400848317493554380070","272229760565825337475560028220194908498"],"threshold":0.9},"id":"CVE-2025-53835-3fe9a3ed","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml5/src/main/java/org/xwiki/rendering/internal/parser/xhtml5/XHTML5Parser.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java"},"deprecated":false,"digest":{"line_hashes":["285075644070890689385138582216399096261","2104193068535243343580555828734909558","2173578174428982986940850510766796429","180182678384495303451677327889269963897","247361348059911814699693166497557606507","251878573224494518277589609578310243710","305536284784332503722420027601074558212","74259117336683292885828270038304194974","227643656237944723232403385529943640582","189987064863638313782573261431760420546","318523714788829390115908869272300642844","213007355005064693930980231768275616627","52192094139726788292555912895183001989","300259454734079958934094445302692908916","68847635016125691964821547701608740540","305628024000144618055389216069168439028","82977498872307031835606629000111807223","224967431582998144150063612406774039079","327757045718972112024295393709045775762","297345927472159497492200940740029116956","335733924257234502065757833758513382495","188365908664216098567205501167000580812","277419041004061405895406741962198998544","148086814737273991138329323247564307357","257537933385287223224822124073823230425","77491356223080709139849583150458771960","111193828702100899760322284367825256394","59290584426061757643475027607532041911","45984223648027117012513060926501825162","268422256115473215004319088606520845784","28966701265663915579653913425762608537","221086182493444329260943820564333131684","151438681152543253794275392158431924380","62039214769653488164198420621098481846","35727596464177233872678328310951262815","158238886833309231365367190450984626238","219613469205343161347949281924113349824","140421008541410867257218001083295635065","298927078008843663527794895313284686666","12604407624112886563653088774833963216","328662089179395633276850174871858948324","172309812839015541598348417595518355891","42296757763410639761061646950707932265","216451542430542132350281878071581732337","134632380990313958666632264463735682406"],"threshold":0.9},"id":"CVE-2025-53835-425db9b2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java","function":"hashCode"},"deprecated":false,"digest":{"length":185,"function_hash":"214470849392320151095687176667288358897"},"id":"CVE-2025-53835-5bba7b31"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["197697016045987841980453583746996284001","225845365884037147481491978070715393919","5051147220995578711784854611180737233","333025871062904427864245317173850845759","7983494428059605438029578039739335571","77661219594389212644801548977998580487","261795282219062389357915461016887657007","301824558509862095147420543034566522928","32095903880828676831135823956986897881","25366704492707235139681090583270376403","74105534428316793617516086991653338072","177263765732799716723323101908993287592","111184934036000636982920458257100069912","50518417851780235139694697682221452598","58237108863661280046475262414069237855","113752254303890579947676238782373897261","56095552873029246949531836114473938192","121288438310976887003421368567238762933","206202496882643531422395161758945032086","207575312361983006300477872400959784207","265419803164029206678331964111950698096","80432037414486410913477502179150609175","134844852885243083608852296341476997135","164911081547070519118618235460883231756","305348179100533876219443515611262498632","96216129168415357433445858776012879071","279517775296224228253120853488655086673","2237377377592358565734053838499353945","108787643227610167858473306954479717975","313573078759352157562237100330979873117","302413039632995082997391850289932590067","52583666581152414977464288920362146293","35816187496174807345714598358437598445","32950081985049957762302421233223862132","54144002020953267022625317943629002842","22250361388420174818549764604714449911"]},"id":"CVE-2025-53835-7b9195b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java"}},{"id":"CVE-2025-53835-821b330e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java","function":"handleLinkCommentStop"},"deprecated":false,"digest":{"function_hash":"10446449803383981758842439061417633581","length":728}},{"source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java"},"deprecated":false,"digest":{"line_hashes":["270030005229975775103044293392161461054","273816346772838141260080787105772190192","49776205134214988468886561169662597270","306246949989662650662336398676223979417","4973112848371045103444354265455949080","2148569885615143171830199322308927402","198351458726922828316652030519881565018","61521305259876102072470582383892890276","242522645917294042693979023044888012875","282310817301345349710298832281928950625","312773969332744614662696838859465346331","300246438480425682931166168972819147318","340248119990543915010750582849436736368","108959153815990726151539455318339100647","81585971004924409350317155038570531350","238872975409383631507648383751741472540","66343113519888662585879500580292340811","4478948316649356157409465319124399444","66815487052378267041951832540495705445","270838493610904210670574115276271450306","61758662210362097033192359585536315920","276596270572906653869493407478671085633","123959251863401374628465238878561122655","122922422973731471983117518311731080264","226173455439788684114158151483339038495","298385834456188731631656651072480882443","64326278756956306728719875677030199293","156110106780477011462931601655526077508","85080404828463597898520435701570283879","70888513304979557321928436259703842884","317681612570223219400848317493554380070","231837987136579270760919704806785357115"],"threshold":0.9},"id":"CVE-2025-53835-9491b3e8","signature_type":"Line","signature_version":"v1"},{"target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java","function":"begin"},"deprecated":false,"digest":{"function_hash":"214460666924983103863072768389708875246","length":1281},"id":"CVE-2025-53835-9a20dff1","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7"},{"id":"CVE-2025-53835-9f703e70","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java","function":"equals"},"deprecated":false,"digest":{"function_hash":"82909718407491478865317240192443027540","length":382}},{"target":{"function":"createWikiModelParser","file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java"},"deprecated":false,"digest":{"function_hash":"225192113946206692990304669238687980206","length":983},"id":"CVE-2025-53835-a6d98e15","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7"},{"digest":{"line_hashes":["12435163603624478805704002636423363879","202038698014319664328431391675550839505","156027888035408944627657099362316617068","178718827685203665955689387273599914185","5570075041506393231595467219086867605","74096910977818958745521730947968084721","152538554688749410180785147819167069215","134591523048063940940235453033033405047","41192683961841263094993251804059612497","278954727505366282395593991700905094549","267353657150229127262929632296267702913","195616505722422049862807091849615229602","203767816185268347396734837985670680985","307543764900001772515139741469959813564","30479638879282341988930587344840811622","165399067726157810117072873388846229141","178371720902819762328669474233005277390","178614910963544526434131692718228881843","178073513685158135258370790662117657498","106082059795613096872302887683916072338","81852063481013499032023955067918284815","239203267731391633500953598848621624020","155468782886835550957533738448720822501","60826044795138761396191333774722958771","21014578604105952407987316727030517858","65264297178004629221701827164994254108","97447687600953347526387603757418288077","70412827614709015158021305550749358674","3524354135825835917294939102310562677","189264300598141598404344635511023157717","210218957823978419172912205490869380672","288375027045089711080717083947083545009","255270273202863821479472382287288547743","155421340849227355877010930677874758414","245994265382395024468191629083073299422","260519400385243054851138620053128476596","100225356242769538545859323906288382736","234956766475173693380559407920035114364","236291510703743276017061332336156879541","304880390981778724571673788203357045397","7764665271819966690509770610143381712","212544485493761489126577419711440527743","128480336814838799858180120906360833752","241543444657740116808624931204911724973","227744790433780371563670395896787549401","207873181155019152219758572245448808156","238463143753623372139813863711912586146","27349830590877223519484851716894105899","252210763899909435039426977353092453435"],"threshold":0.9},"id":"CVE-2025-53835-d206db0a","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XHTMLXWikiGeneratorListener.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"152255333906688912805298595736712724322","length":558},"id":"CVE-2025-53835-d6133d93","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java","function":"handleLinkCommentStart"}},{"digest":{"function_hash":"135611794718721112311748151606158646101","length":162},"id":"CVE-2025-53835-dc156160","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java","function":"XWikiCommentHandler"},"deprecated":false},{"id":"CVE-2025-53835-ed92c5f7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7","target":{"file":"xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java","function":"getLinkLabelParser"},"deprecated":false,"digest":{"function_hash":"100974503806799791611851696571561148646","length":48}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}