THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-26vp-8gxg-v4pg (critical) — org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

[GHSA] GHSA-26vp-8gxg-v4pg (critical) — org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

highgithub_advisoriesPublished 2026-09-18

GHSA-26vp-8gxg-v4pg Severity: critical CVE: CVE-2025-53837

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

### Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that ren

Indicators of compromise

CVE-2025-53837cve
https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/ExtensionPoint/Suggestions%20for%20Document%20Does%20Not%20Exist/url
https://jira.xwiki.org/url
security@xwiki.orgemail

Original source: https://github.com/advisories/GHSA-26vp-8gxg-v4pg