CVE-2025-46558

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-46558

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46558.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-46558

Aliases

GHSA-8g2j-rhfh-hq3r

Published

2025-04-30T18:27:30.953Z

Modified

2026-04-02T12:48:32.192101Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

Details

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that this code is executed by a user with admins or programming rights, this issue compromises the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in version 8.9.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46558.json",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/xwiki-contrib/syntax-markdown

Affected ranges

Type: GIT
Repo: https://github.com/xwiki-contrib/syntax-markdown
Events: Introduced

58f8648921631c7805b8bf207145cb64d4450a3a

Fixed

9a45171f9ace332315d09563129854c18ff3fb8c

Affected versions

syntax-markdown-8.*

syntax-markdown-8.2

syntax-markdown-8.3

syntax-markdown-8.4

syntax-markdown-8.4.1

syntax-markdown-8.4.2

syntax-markdown-8.4.3

syntax-markdown-8.5

syntax-markdown-8.5.1

syntax-markdown-8.5.2

syntax-markdown-8.5.3

syntax-markdown-8.5.4

syntax-markdown-8.6

syntax-markdown-8.7

syntax-markdown-8.7.1

syntax-markdown-8.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46558.json"