CVE-2025-53837: Remote Code Execution in XWiki Rendering via Macro Escape Injection

XWiki is a highly extensible, Java-based enterprise wiki platform that supports advanced scripting and rendering. At the core of its platform is the XWiki Rendering engine, a framework responsible for translating multiple input syntaxes (such as XWiki 2.1, Markdown, or HTML) into output formats like XHTML. A key design element of XWiki is its support for nested macros, which are dynamic blocks that execute code, format content, or interface with internal services. Among these, the HTML macro allows users to embed raw HTML components within standard wiki pages.

The vulnerability, identified as CVE-2025-53837, resides in how XWiki processes raw output inside the HTML macro context. When executing with the configuration wiki="true", the HTML macro processes dynamic evaluations within an isolated container. However, the system's underlying rendering handler failed to properly escape macro delimiters when outputting raw data. This omission exposes a vulnerability class known as Eval Injection (CWE-95) combined with Output Escaping Failure (CWE-116).

The practical security boundary breached here is the rendering sandbox. In XWiki, page editors can customize certain profile sections or document pages. If a low-privilege user can modify any page that gets executed or viewed under a highly privileged context, they can leverage this rendering vulnerability to elevate privileges. When the system processes the user-supplied content containing macro closing sequences, it breaks the macro boundaries and executes subsequent script elements with system-level authorization.

The root cause of CVE-2025-53837 lies within the XHTMLWikiPrinter class, which is a key component of the XWiki Rendering library. This class handles the construction of XHTML tags and manages raw output when generating serialized wiki streams. When an HTML macro is invoked with the parameter wiki="true", the content inside the macro is analyzed and converted. To achieve direct output without double-encoding standard HTML structures, the engine invokes printRaw(String) to output raw text segments to the final rendering channel.

Prior to the resolution of this vulnerability, the printRaw method implemented in XHTMLWikiPrinter did not examine the contents of the raw buffer for active macro delimiters. The exact structure used to terminate an HTML macro block is the sequence {{/html}}. Because the renderer treated raw input as trustable structural content, any literal sequence matching {{/html}} injected into a raw string was output directly to the stream. This directly terminated the parser's active HTML macro block ahead of schedule.

Once the HTML macro container is prematurely terminated, the parser transitions back to interpreting standard wiki syntax. Any syntax elements following the injected {{/html}} sequence are parsed outside the HTML macro. Crucially, if this rendering process occurs on pages with programming rights—such as standard user profile pages or administrative views—the parser executes arbitrary macro blocks located after the fake termination. An attacker can append administrative scripting macros, such as {{groovy}} or {{python}}, which run code outside of the typical sandboxed environment. This architectural flaw converts a simple content-rendering step into an unrestricted execution vector.

An examination of the vulnerable implementation versus the patched implementation demonstrates how the boundary leak was closed. In the vulnerable version, XHTMLWikiPrinter.java implemented the printRaw(String) method with a direct pass-through to its parent class. This class failed to scan for the macro delimiter sequence {{/html}}, allowing raw text to influence the parser's structural boundaries.

// Vulnerable Implementation
public void printRaw(String raw)
{
    // Triggers space handling before starting elements
    handleSpaceWhenStartElement();
    
    // Passes the raw string directly to the parent printer without validation
    super.printRaw(raw);
}

The fix, introduced in commit 92bc8095ed3acce15ab200c8525e1623b4898be5, introduces structured validation and replacement rules inside printRaw(String) to prevent context-escape attempts. It sanitizes the direct sequence and also prevents boundary-spanning injection techniques.

// Patched Implementation in XHTMLWikiPrinter.java
public void printRaw(String raw)
\{
    handleSpaceWhenStartElement();
    
    // First-stage fix: Escape any direct occurrences of the closing tag
    // By replacing "\{\