CVE-2025-53093 (GCVE-0-2025-53093)
Vulnerability from cvelistv5 – Published: 2025-06-27 17:43 – Updated: 2025-06-27 17:56
VLAI
EPSS
VEX
Title
TabberNeue vulnerable to Stored XSS through wikitext
Summary
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-27 17:52 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_CONFIRM |
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_MISC |
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_MISC |
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_MISC |
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_MISC |
| https://github.com/StarCitizenTools/mediawiki-ext… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| StarCitizenTools | mediawiki-extensions-TabberNeue |
Affected:
>= 3.0.0, < 3.1.1
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53093",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-27T17:52:29.743640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-27T17:56:37.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mediawiki-extensions-TabberNeue",
"vendor": "StarCitizenTools",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-27T17:43:24.107Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1"
}
],
"source": {
"advisory": "GHSA-jfj7-249r-7j2m",
"discovery": "UNKNOWN"
},
"title": "TabberNeue vulnerable to Stored XSS through wikitext"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-53093",
"datePublished": "2025-06-27T17:43:24.107Z",
"dateReserved": "2025-06-25T13:41:23.085Z",
"dateUpdated": "2025-06-27T17:56:37.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-53093",
"date": "2026-09-29",
"epss": "0.0042",
"percentile": "0.33841"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "mediawiki-extensions-TabberNeue",
"vendor": "StarCitizenTools",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug."
},
{
"lang": "es",
"value": "TabberNeue es una extensi\u00f3n de MediaWiki que permite crear pesta\u00f1as en la wiki. A partir de la versi\u00f3n 3.0.0 y anteriores a la 3.1.1, cualquier usuario puede insertar HTML arbitrario en el DOM insertando un payload en cualquier atributo permitido de la etiqueta ``. La versi\u00f3n 3.1.1 incluye un parche para este error."
}
],
"id": "CVE-2025-53093",
"lastModified": "2026-06-17T09:37:36.700",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-53093",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-27T17:52:29.743640Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-06-27T18:15:50.773",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-80"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-06-29T18:05:15+00:00",
"cve": "CVE-2025-53093",
"id": "CVE-2025-53093",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "TabberNeue vulnerable to Stored XSS through wikitext",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53093.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53093",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-27T17:52:29.743640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-27T17:53:05.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mediawiki-extensions-TabberNeue",
"vendor": "StarCitizenTools",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-27T17:43:24.107Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76"
},
{
"name": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1"
}
],
"source": {
"advisory": "GHSA-jfj7-249r-7j2m",
"discovery": "UNKNOWN"
},
"title": "TabberNeue vulnerable to Stored XSS through wikitext"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-53093",
"datePublished": "2025-06-27T17:43:24.107Z",
"dateReserved": "2025-06-25T13:41:23.085Z",
"dateUpdated": "2025-06-27T17:56:37.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
FKIE_CVE-2025-53093
Vulnerability from fkie_nvd - Published: 2025-06-27 18:15 - Updated: 2026-06-17 09:37
Severity
Summary
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "mediawiki-extensions-TabberNeue",
"vendor": "StarCitizenTools",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.1.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug."
},
{
"lang": "es",
"value": "TabberNeue es una extensi\u00f3n de MediaWiki que permite crear pesta\u00f1as en la wiki. A partir de la versi\u00f3n 3.0.0 y anteriores a la 3.1.1, cualquier usuario puede insertar HTML arbitrario en el DOM insertando un payload en cualquier atributo permitido de la etiqueta ``. La versi\u00f3n 3.1.1 incluye un parche para este error."
}
],
"id": "CVE-2025-53093",
"lastModified": "2026-06-17T09:37:36.700",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-53093",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-27T17:52:29.743640Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-06-27T18:15:50.773",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-80"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-JFJ7-249R-7J2M
Vulnerability from github – Published: 2025-06-27 20:50 – Updated: 2025-06-27 20:50
VLAI
Summary
TabberNeue vulnerable to Stored XSS through wikitext
Details
Summary
Arbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the <tabber> tag.
Details
The args provided within the wikitext as attributes to the <tabber> tag are passed to the TabberComponentTabs class:
https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76
In TabberComponentTabs, the attributes are validated before being supplied to the Tabs template.
https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31
However, the validation is insufficient.
What Sanitizer::validateTagAttributes does is call validateAttributes, which
* - Discards attributes not on the given list
* - Unsafe style attributes are discarded
* - Invalid id attributes are re-encoded
However, the attribute values are expected to be escaped when inserted into HTML.
The attribute values are then inserted into HTML without being escaped: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1
PoC
XSS through attributes:
- Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123" onmouseenter="alert(1)"'>
|-|First Tab Title=
First tab content goes here.
</tabber>
- Press "OK"
- Hover over the tabber
XSS through script tags:
- Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123"><script>alert(2)</script>'>
|-|First Tab Title=
First tab content goes here.
</tabber>
- Press "OK"
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
Severity
8.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "starcitizentools/tabber-neue"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53093"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-80"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-27T20:50:40Z",
"nvd_published_at": "2025-06-27T18:15:50Z",
"severity": "HIGH"
},
"details": "### Summary\nArbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag.\n\n### Details\n\nThe `args` provided within the wikitext as attributes to the `\u003ctabber\u003e` tag are passed to the TabberComponentTabs class:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76\n\nIn TabberComponentTabs, the attributes are validated before being supplied to the Tabs template.\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31\nHowever, the validation is insufficient.\nWhat `Sanitizer::validateTagAttributes` does is call `validateAttributes`, which\n```\n\t * - Discards attributes not on the given list\n\t * - Unsafe style attributes are discarded\n\t * - Invalid id attributes are re-encoded\n```\nHowever, the attribute values are expected to be escaped when inserted into HTML.\n\nThe attribute values are then inserted into HTML without being escaped:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1\n\n### PoC\n#### XSS through attributes:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class=\u0027test123\" onmouseenter=\"alert(1)\"\u0027\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n3. Hover over the tabber\n\n\n\n\n#### XSS through script tags:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class=\u0027test123\"\u0026gt;\u0026lt;script\u0026gt;alert(2)\u0026lt;/script\u0026gt;\u0027\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.",
"id": "GHSA-jfj7-249r-7j2m",
"modified": "2025-06-27T20:50:40Z",
"published": "2025-06-27T20:50:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53093"
},
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612"
},
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue"
},
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31"
},
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76"
},
{
"type": "WEB",
"url": "https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "TabberNeue vulnerable to Stored XSS through wikitext"
}
WID-SEC-W-2025-1525
Vulnerability from csaf_certbund - Published: 2025-07-09 22:00 - Updated: 2025-07-23 22:00Summary
MediaWiki Extensions und Skins: Mehrere Schwachstellen
Severity
Hoch
Scope
42 vulnerabilities in this advisory, including CVE-2025-53093.
CVE-2025-53093
Known affected: 4 products
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…