CVE-2023-31126

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-86 CWE-79

Affected software

Vendor	Product	Versions
xwiki	xwiki-commons	>= 14.6-rc-1, < 14.10.4

References

https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e7457043938f35265b2aa5adc76a68Patch
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-pv7v-ph6g-3gxvVendor Advisory
https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory
https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e7457043938f35265b2aa5adc76a68Patch
https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-pv7v-ph6g-3gxvVendor Advisory
https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory
https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-311278.8libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishm CVE-2023-311288.8NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, CVE-2023-311299.8The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 CVE-2023-31137.5An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resul CVE-2023-311306.4c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particul CVE-2023-311319.1Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsaf CVE-2023-311327.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulne CVE-2023-311337.5Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to mem CVE-2023-311345.4Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites CVE-2023-311355.5Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisi CVE-2023-311365.9PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vuln CVE-2023-311377.5MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer