CVE-2023-29528

XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.

• CWE-79

• https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04abPatch
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6hVendor Advisory
• https://jira.xwiki.org/browse/XCOMMONS-2568Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20348Exploit, Vendor Advisory
• https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04abPatch
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-x37v-36wv-6v6hVendor Advisory
• https://jira.xwiki.org/browse/XCOMMONS-2568Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-20348Exploit, Vendor Advisory

Published

Apr 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29522XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29523XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29524XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29525XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29526XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29527XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-29529matrix-js-sdk is the Matrix Client-Server SDK for JavaScript…5.3
• CVE-2023-2953A vulnerability was found in openldap. This security flaw ca…7.5
• CVE-2023-29530Laminas Diactoros provides PSR HTTP Message implementations.…6.5
• CVE-2023-29531An attacker could have caused an out of bounds memory access…9.8
• CVE-2023-29532A local attacker can trick the Mozilla Maintenance Service i…5.5
• CVE-2023-29533A website could have obscured the fullscreen notification by…4.3