org.xwiki.rendering/xwiki-rendering-xml vulnerabilities

Latest org.xwiki.rendering/xwiki-rendering-xml CVEs

Newest publication first

1. CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

   Published 2026-09-18

   Critical·CVSS 9.9 EPSS 1.5%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary...

2. CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

   Published 2025-12-10

   High·CVSS 8.7 EPSS 1.1%

   XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against {{/htm...

3. CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

   Published 2023-10-25

   Critical·CVSS 9.6 EPSS 1.1%

   XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via inva...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.