Every CVE Search/ Get API key

CVE-2025-53093

TabberNeue vulnerable to Stored XSS through wikitext

8.6 HighFix available

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.42%Up 0.4 points since Jun 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.6

TabberNeue vulnerable to Stored XSS through wikitext

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Record
CVE-2025-53093
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02
EUVDEUVD-2025-19418 8.6

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Record
EUVD-2025-19418
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-jfj7-249r-7j2m 8.6

TabberNeue vulnerable to Stored XSS through wikitext

Summary

Arbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the <tabber> tag.

Details

The args provided within the wikitext as attributes to the <tabber> tag are passed to the TabberComponentTabs class: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76

In TabberComponentTabs, the attributes are validated before being supplied to the Tabs template. https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31 However, the validation is insufficient. What Sanitizer::validateTagAttributes does is call validateAttributes, which

	 * - Discards attributes not on the given list
	 * - Unsafe style attributes are discarded
	 * - Invalid id attributes are re-encoded

However, the attribute values are expected to be escaped when inserted into HTML.

The attribute values are then inserted into HTML without being escaped: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1

PoC

XSS through attributes:

  1. Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123" onmouseenter="alert(1)"'>
|-|First Tab Title=
First tab content goes here.
</tabber>
  1. Press "OK"
  2. Hover over the tabber

XSS through script tags:

  1. Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123"&gt;&lt;script&gt;alert(2)&lt;/script&gt;'>
|-|First Tab Title=
First tab content goes here.
</tabber>
  1. Press "OK"

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

Record
GHSA-jfj7-249r-7j2m
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02
NVD 8.6

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Record
CVE-2025-53093
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSV 8.6

TabberNeue vulnerable to Stored XSS through wikitext

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Record
CVE-2025-53093
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSVGHSA-jfj7-249r-7j2m 8.6

TabberNeue vulnerable to Stored XSS through wikitext

Summary

Arbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the <tabber> tag.

Details

The args provided within the wikitext as attributes to the <tabber> tag are passed to the TabberComponentTabs class: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76

In TabberComponentTabs, the attributes are validated before being supplied to the Tabs template. https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31 However, the validation is insufficient. What Sanitizer::validateTagAttributes does is call validateAttributes, which

	 * - Discards attributes not on the given list
	 * - Unsafe style attributes are discarded
	 * - Invalid id attributes are re-encoded

However, the attribute values are expected to be escaped when inserted into HTML.

The attribute values are then inserted into HTML without being escaped: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1

PoC

XSS through attributes:

  1. Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123" onmouseenter="alert(1)"'>
|-|First Tab Title=
First tab content goes here.
</tabber>
  1. Press "OK"
  2. Hover over the tabber

XSS through script tags:

  1. Go to Special:ExpandTemplates and insert the following wikitext:
<tabber class='test123"&gt;&lt;script&gt;alert(2)&lt;/script&gt;'>
|-|First Tab Title=
First tab content goes here.
</tabber>
  1. Press "OK"

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

Record
GHSA-jfj7-249r-7j2m
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
starcitizentools/tabber-neue
Packagist
 3.0.0 up to 3.1.1
3.1.1
starcitizentools/tabber-neue
Packagist
 3.0.0 up to 3.1.1, plus listed versions
v3.0.0v3.1.0
3.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53093 is a high vulnerability (CVSS 8.6) in Starcitizentools Mediawiki-extensions-tabberneue, published June 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in starcitizentools/tabber-neue 3.1.1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open