{"id":"CVE-2025-53093","aliases":["EUVD-2025-19418","GHSA-jfj7-249r-7j2m"],"status":"published","title":"TabberNeue vulnerable to Stored XSS through wikitext","description":"TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0042,"percentile":0.36801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2025-06-27T17:43:24Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Packagist","package":"starcitizentools/tabber-neue","fixed_in":["3.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizentools/tabber-neue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizentools/tabber-neue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.1"}]}],"versions":["v3.0.0","v3.1.0"]}],"products":[{"vendor":"starcitizentools","product":"mediawiki-extensions-tabberneue"}],"references":[{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-jfj7-249r-7j2m","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/4cdf217ef96da74a1503d1dd0bb0ed898fc2a612","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/62ce0fcdf32bd3cfa77f92ff6b940459a14315fa","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53093","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jfj7-249r-7j2m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53093.json","tags":["advisory"]},{"url":"https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-53093","title":"TabberNeue vulnerable to Stored XSS through wikitext","description":"TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug.","status":"published","published":"2025-06-27T17:43:24.107Z","modified":"2025-06-27T17:56:37.678Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-19418","description":"TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug.","status":"published","published":"2025-06-27T17:43:24Z","modified":"2025-06-27T17:56:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:15.785343Z"}],"ghsa":[{"id":"GHSA-jfj7-249r-7j2m","title":"TabberNeue vulnerable to Stored XSS through wikitext","description":"### Summary\nArbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag.\n\n### Details\n\nThe `args` provided within the wikitext as attributes to the `\u003ctabber\u003e` tag are passed to the TabberComponentTabs class:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76\n\nIn TabberComponentTabs, the attributes are validated before being supplied to the Tabs template.\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31\nHowever, the validation is insufficient.\nWhat `Sanitizer::validateTagAttributes` does is call `validateAttributes`, which\n```\n\t * - Discards attributes not on the given list\n\t * - Unsafe style attributes are discarded\n\t * - Invalid id attributes are re-encoded\n```\nHowever, the attribute values are expected to be escaped when inserted into HTML.\n\nThe attribute values are then inserted into HTML without being escaped:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1\n\n### PoC\n#### XSS through attributes:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class='test123\" onmouseenter=\"alert(1)\"'\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n3. Hover over the tabber\n\n![image](https://github.com/user-attachments/assets/bb65a587-e277-4936-b9f9-400ad7c39040)\n\n\n#### XSS through script tags:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class='test123\"\u0026gt;\u0026lt;script\u0026gt;alert(2)\u0026lt;/script\u0026gt;'\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n![image](https://github.com/user-attachments/assets/a51ede5c-f9a0-49be-875e-37d30a083721)\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.","status":"published","published":"2025-06-27T20:50:40Z","modified":"2025-06-27T20:51:57Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"nvd":[{"id":"CVE-2025-53093","description":"TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug.","status":"published","published":"2025-06-27T18:15:50.773Z","modified":"2026-06-17T09:37:36.7Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:11:14.781314Z"}],"osv":[{"id":"CVE-2025-53093","title":"TabberNeue vulnerable to Stored XSS through wikitext","description":"TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag. Version 3.1.1 contains a patch for the bug.","status":"published","published":"2025-06-27T17:43:24.107Z","modified":"2026-10-28T02:30:44.31973054Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-jfj7-249r-7j2m","title":"TabberNeue vulnerable to Stored XSS through wikitext","description":"### Summary\nArbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the `\u003ctabber\u003e` tag.\n\n### Details\n\nThe `args` provided within the wikitext as attributes to the `\u003ctabber\u003e` tag are passed to the TabberComponentTabs class:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76\n\nIn TabberComponentTabs, the attributes are validated before being supplied to the Tabs template.\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31\nHowever, the validation is insufficient.\nWhat `Sanitizer::validateTagAttributes` does is call `validateAttributes`, which\n```\n\t * - Discards attributes not on the given list\n\t * - Unsafe style attributes are discarded\n\t * - Invalid id attributes are re-encoded\n```\nHowever, the attribute values are expected to be escaped when inserted into HTML.\n\nThe attribute values are then inserted into HTML without being escaped:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1\n\n### PoC\n#### XSS through attributes:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class='test123\" onmouseenter=\"alert(1)\"'\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n3. Hover over the tabber\n\n![image](https://github.com/user-attachments/assets/bb65a587-e277-4936-b9f9-400ad7c39040)\n\n\n#### XSS through script tags:\n1. Go to Special:ExpandTemplates and insert the following wikitext:\n```\n\u003ctabber class='test123\"\u0026gt;\u0026lt;script\u0026gt;alert(2)\u0026lt;/script\u0026gt;'\u003e\n|-|First Tab Title=\nFirst tab content goes here.\n\u003c/tabber\u003e\n```\n2. Press \"OK\"\n![image](https://github.com/user-attachments/assets/a51ede5c-f9a0-49be-875e-37d30a083721)\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.","status":"published","published":"2025-06-27T20:50:40Z","modified":"2025-06-27T21:42:16.750392Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}