CVE-2025-53835
- Source
- https://cve.org/CVERecord?id=CVE-2025-53835
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53835.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-53835
- Aliases
- Published
- 2025-07-14T23:00:35.577Z
- Modified
- 2026-08-12T15:14:00.087264Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
- Details
-
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the
xdom+xml/currentsyntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on thexdom+xml/currentsyntax from the XHTML syntax. Note that thexdom+xmlsyntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading. - Database specific
{ "cwe_ids": [ "CWE-79", "CWE-80" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53835.json", "cna_assigner": "GitHub_M" }- References
-
- https://jira.xwiki.org/browse/XRENDERING-660
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53835.json
- https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783p
- https://nvd.nist.gov/vuln/detail/CVE-2025-53835
- https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "5.4.5" }, { "fixed": "14.10" } ], "source": "CPE_RANGE" }
Database specific
vanir_signatures_modified
"2026-08-12T15:14:00Z"
vanir_signatures
[
{
"id": "CVE-2025-53835-023c68fd",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 88.0,
"function_hash": "189082468535516669982665348719894321556"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "XWikiReferenceTagHandler",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java"
}
},
{
"id": "CVE-2025-53835-077a9c2b",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"198013157354009262904043909990988332653",
"255967728227037812884506606910282037788",
"111880295937277975117310539791026637612",
"299664359688471520661180973433711780746",
"170222426215186596783360611650025296118",
"148176601046084096919035416738703039193",
"297302385880043665963054104079664448644",
"55541355812333144103595681787316195819",
"144358829556288497657705011771214937861",
"284879517638933754486846828618910647811",
"278274653455863128907926880094729347996",
"89811086831095339917139008399801952677",
"121081023559973028021230400960753190694",
"126796942043548825188176555120394474220",
"121602170183701992524696815932905978658",
"9073636036831059636488847810150742637",
"193233962265273194937252990279941607225",
"322443853582538603584824793662844479256",
"239980935880466834424768958493831989456",
"155302226198900246552053876990926913237"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java"
}
},
{
"id": "CVE-2025-53835-15572632",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 705.0,
"function_hash": "219022125095746337381869594531155194613"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "end",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java"
}
},
{
"id": "CVE-2025-53835-20e85c84",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 165.0,
"function_hash": "18241624895036448727015291908870603908"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "XWikiWikiReference",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java"
}
},
{
"id": "CVE-2025-53835-37a7dc9e",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 447.0,
"function_hash": "295063003632489478147860261147414406216"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "onReference",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XHTMLXWikiGeneratorListener.java"
}
},
{
"id": "CVE-2025-53835-3def8f52",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1103.0,
"function_hash": "252132106396726785239700640019065275224"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "createWikiModelParser",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml5/src/main/java/org/xwiki/rendering/internal/parser/xhtml5/XHTML5Parser.java"
}
},
{
"id": "CVE-2025-53835-3fe9a3ed",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244579708665859518725806772246227140959",
"94906987664196671141336078981037802742",
"231891248392324256214930287481300648192",
"327832489969432250604053709439303463382",
"293314616600054940024984884307616456636",
"260312162472155426875194215072860165821",
"94392039017049511559779804138992497022",
"316605763741727863690577195141229145482",
"263203334618110576452664385663949332890",
"300101566511181899714375189446771948323",
"57827792390163316713279241546885713577",
"151468965497157078124789087976672972599",
"66815211660678809529307001951600458546",
"332287135875228037325838417223227910056",
"229478906880294237454536518368022959765",
"143129557437173922569570271143083766072",
"66343113519888662585879500580292340811",
"315478245091188287162932882786793983434",
"175254954682694711583259755637204773968",
"122922422973731471983117518311731080264",
"226173455439788684114158151483339038495",
"134455227534881967461417227673819532854",
"334679339227538002082880531377779452632",
"229152247639381757667321774053254839996",
"85080404828463597898520435701570283879",
"70888513304979557321928436259703842884",
"317681612570223219400848317493554380070",
"272229760565825337475560028220194908498"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml5/src/main/java/org/xwiki/rendering/internal/parser/xhtml5/XHTML5Parser.java"
}
},
{
"id": "CVE-2025-53835-425db9b2",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"285075644070890689385138582216399096261",
"2104193068535243343580555828734909558",
"2173578174428982986940850510766796429",
"180182678384495303451677327889269963897",
"247361348059911814699693166497557606507",
"251878573224494518277589609578310243710",
"305536284784332503722420027601074558212",
"74259117336683292885828270038304194974",
"227643656237944723232403385529943640582",
"189987064863638313782573261431760420546",
"318523714788829390115908869272300642844",
"213007355005064693930980231768275616627",
"52192094139726788292555912895183001989",
"300259454734079958934094445302692908916",
"68847635016125691964821547701608740540",
"305628024000144618055389216069168439028",
"82977498872307031835606629000111807223",
"224967431582998144150063612406774039079",
"327757045718972112024295393709045775762",
"297345927472159497492200940740029116956",
"335733924257234502065757833758513382495",
"188365908664216098567205501167000580812",
"277419041004061405895406741962198998544",
"148086814737273991138329323247564307357",
"257537933385287223224822124073823230425",
"77491356223080709139849583150458771960",
"111193828702100899760322284367825256394",
"59290584426061757643475027607532041911",
"45984223648027117012513060926501825162",
"268422256115473215004319088606520845784",
"28966701265663915579653913425762608537",
"221086182493444329260943820564333131684",
"151438681152543253794275392158431924380",
"62039214769653488164198420621098481846",
"35727596464177233872678328310951262815",
"158238886833309231365367190450984626238",
"219613469205343161347949281924113349824",
"140421008541410867257218001083295635065",
"298927078008843663527794895313284686666",
"12604407624112886563653088774833963216",
"328662089179395633276850174871858948324",
"172309812839015541598348417595518355891",
"42296757763410639761061646950707932265",
"216451542430542132350281878071581732337",
"134632380990313958666632264463735682406"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java"
}
},
{
"id": "CVE-2025-53835-5bba7b31",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 185.0,
"function_hash": "214470849392320151095687176667288358897"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "hashCode",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java"
}
},
{
"id": "CVE-2025-53835-7b9195b3",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"197697016045987841980453583746996284001",
"225845365884037147481491978070715393919",
"5051147220995578711784854611180737233",
"333025871062904427864245317173850845759",
"7983494428059605438029578039739335571",
"77661219594389212644801548977998580487",
"261795282219062389357915461016887657007",
"301824558509862095147420543034566522928",
"32095903880828676831135823956986897881",
"25366704492707235139681090583270376403",
"74105534428316793617516086991653338072",
"177263765732799716723323101908993287592",
"111184934036000636982920458257100069912",
"50518417851780235139694697682221452598",
"58237108863661280046475262414069237855",
"113752254303890579947676238782373897261",
"56095552873029246949531836114473938192",
"121288438310976887003421368567238762933",
"206202496882643531422395161758945032086",
"207575312361983006300477872400959784207",
"265419803164029206678331964111950698096",
"80432037414486410913477502179150609175",
"134844852885243083608852296341476997135",
"164911081547070519118618235460883231756",
"305348179100533876219443515611262498632",
"96216129168415357433445858776012879071",
"279517775296224228253120853488655086673",
"2237377377592358565734053838499353945",
"108787643227610167858473306954479717975",
"313573078759352157562237100330979873117",
"302413039632995082997391850289932590067",
"52583666581152414977464288920362146293",
"35816187496174807345714598358437598445",
"32950081985049957762302421233223862132",
"54144002020953267022625317943629002842",
"22250361388420174818549764604714449911"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java"
}
},
{
"id": "CVE-2025-53835-821b330e",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 728.0,
"function_hash": "10446449803383981758842439061417633581"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "handleLinkCommentStop",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java"
}
},
{
"id": "CVE-2025-53835-9491b3e8",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270030005229975775103044293392161461054",
"273816346772838141260080787105772190192",
"49776205134214988468886561169662597270",
"306246949989662650662336398676223979417",
"4973112848371045103444354265455949080",
"2148569885615143171830199322308927402",
"198351458726922828316652030519881565018",
"61521305259876102072470582383892890276",
"242522645917294042693979023044888012875",
"282310817301345349710298832281928950625",
"312773969332744614662696838859465346331",
"300246438480425682931166168972819147318",
"340248119990543915010750582849436736368",
"108959153815990726151539455318339100647",
"81585971004924409350317155038570531350",
"238872975409383631507648383751741472540",
"66343113519888662585879500580292340811",
"4478948316649356157409465319124399444",
"66815487052378267041951832540495705445",
"270838493610904210670574115276271450306",
"61758662210362097033192359585536315920",
"276596270572906653869493407478671085633",
"123959251863401374628465238878561122655",
"122922422973731471983117518311731080264",
"226173455439788684114158151483339038495",
"298385834456188731631656651072480882443",
"64326278756956306728719875677030199293",
"156110106780477011462931601655526077508",
"85080404828463597898520435701570283879",
"70888513304979557321928436259703842884",
"317681612570223219400848317493554380070",
"231837987136579270760919704806785357115"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java"
}
},
{
"id": "CVE-2025-53835-9a20dff1",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1281.0,
"function_hash": "214460666924983103863072768389708875246"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "begin",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiReferenceTagHandler.java"
}
},
{
"id": "CVE-2025-53835-9f703e70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 382.0,
"function_hash": "82909718407491478865317240192443027540"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "equals",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiWikiReference.java"
}
},
{
"id": "CVE-2025-53835-a6d98e15",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 983.0,
"function_hash": "225192113946206692990304669238687980206"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "createWikiModelParser",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java"
}
},
{
"id": "CVE-2025-53835-d206db0a",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"12435163603624478805704002636423363879",
"202038698014319664328431391675550839505",
"156027888035408944627657099362316617068",
"178718827685203665955689387273599914185",
"5570075041506393231595467219086867605",
"74096910977818958745521730947968084721",
"152538554688749410180785147819167069215",
"134591523048063940940235453033033405047",
"41192683961841263094993251804059612497",
"278954727505366282395593991700905094549",
"267353657150229127262929632296267702913",
"195616505722422049862807091849615229602",
"203767816185268347396734837985670680985",
"307543764900001772515139741469959813564",
"30479638879282341988930587344840811622",
"165399067726157810117072873388846229141",
"178371720902819762328669474233005277390",
"178614910963544526434131692718228881843",
"178073513685158135258370790662117657498",
"106082059795613096872302887683916072338",
"81852063481013499032023955067918284815",
"239203267731391633500953598848621624020",
"155468782886835550957533738448720822501",
"60826044795138761396191333774722958771",
"21014578604105952407987316727030517858",
"65264297178004629221701827164994254108",
"97447687600953347526387603757418288077",
"70412827614709015158021305550749358674",
"3524354135825835917294939102310562677",
"189264300598141598404344635511023157717",
"210218957823978419172912205490869380672",
"288375027045089711080717083947083545009",
"255270273202863821479472382287288547743",
"155421340849227355877010930677874758414",
"245994265382395024468191629083073299422",
"260519400385243054851138620053128476596",
"100225356242769538545859323906288382736",
"234956766475173693380559407920035114364",
"236291510703743276017061332336156879541",
"304880390981778724571673788203357045397",
"7764665271819966690509770610143381712",
"212544485493761489126577419711440527743",
"128480336814838799858180120906360833752",
"241543444657740116808624931204911724973",
"227744790433780371563670395896787549401",
"207873181155019152219758572245448808156",
"238463143753623372139813863711912586146",
"27349830590877223519484851716894105899",
"252210763899909435039426977353092453435"
]
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XHTMLXWikiGeneratorListener.java"
}
},
{
"id": "CVE-2025-53835-d6133d93",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 558.0,
"function_hash": "152255333906688912805298595736712724322"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "handleLinkCommentStart",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java"
}
},
{
"id": "CVE-2025-53835-dc156160",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 162.0,
"function_hash": "135611794718721112311748151606158646101"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "XWikiCommentHandler",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/wikimodel/XWikiCommentHandler.java"
}
},
{
"id": "CVE-2025-53835-ed92c5f7",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 48.0,
"function_hash": "100974503806799791611851696571561148646"
},
"source": "https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7",
"target": {
"function": "getLinkLabelParser",
"file": "xwiki-rendering-syntaxes/xwiki-rendering-syntax-xhtml/src/main/java/org/xwiki/rendering/internal/parser/xhtml/XHTMLParser.java"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53835.json"