XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. This has been patched in XWiki 14.10.2 and 15.0 RC1 by making sure that rendering output cannot close the surrounding HTML macro. A possible workaround is available. It is, in principle, possible to add escaping to all places where rendering output is used in wiki documents, but at the moment there is no list of them.
CVE-2025-53837
This critical-severity CVE scores 9.9 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 9.9
- EG Score
- 9.9(low)
- EG Risk
- 49(Track)EG Risk 49/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity99% × 45%Exploitation0% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- Not listed
Published
September 18, 2026
Last Modified
September 18, 2026
Advisory Details (5)
Auto-updated Sep 18, 2026Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.rendering:xwiki-rendering-xml · Advisory · xwiki/xwiki-rendering · GitHub
https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-26vp-8gxg-v4pgcommit 92bc8095ed3a (xwiki/xwiki-rendering)
Patch available: xwiki/xwiki-rendering xwiki-rendering-17.10.4 (contains commit 92bc8095ed3a)
https://github.com/xwiki/xwiki-rendering/commit/92bc8095ed3acce15ab200c8525e1623b4898be5Vendor Advisories for CVE-2025-53837(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
Maven(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| org.xwiki.rendering:xwiki-rendering-xml | 10.0 ... 9.9-rc-2 (353 versions) | 14.10.2 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 3× in last 7d / 3× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-18 16:27 UTCEG score recompute
- 2026-09-18 15:24 UTCEG score recompute
- 2026-09-18 15:24 UTCMITRE cvelistV5first tracked
Frequently asked(4)
What is CVE-2025-53837?
When was CVE-2025-53837 disclosed?
What is the CVSS score of CVE-2025-53837?
How do I remediate CVE-2025-53837?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-53837
Is Your Infrastructure Affected by CVE-2025-53837?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.