CVE-2023-31126

`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names. This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters. There are no known workarounds apart from upgrading to a version including the fix.

• CWE-86
• CWE-79

• https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e7457043938f35265b2aa5adc76a68Patch
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-pv7v-ph6g-3gxvVendor Advisory
• https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory
• https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e7457043938f35265b2aa5adc76a68Patch
• https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-pv7v-ph6g-3gxvVendor Advisory
• https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory
• https://jira.xwiki.org/browse/XCOMMONS-2606Vendor Advisory

Published

May 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31116An issue was discovered in the Shannon RCS component in Sams…9.8
• CVE-2023-3112A vulnerability was reported in Elliptic Labs Virtual Lock S…7.8
• CVE-2023-31122Out-of-bounds Read vulnerability in mod_macro of Apache HTTP…7.5
• CVE-2023-31123`effectindex/tripreporter` is a community-powered, universal…9.1
• CVE-2023-31124c-ares is an asynchronous resolver library. When cross-compi…3.7
• CVE-2023-31125Engine.IO is the implementation of transport-based cross-bro…6.5
• CVE-2023-31127libspdm is a sample implementation that follows the DMTF SPD…8.8
• CVE-2023-31128NextCloud Cookbook is a recipe library app. Prior to commit …8.8
• CVE-2023-31129The Contiki-NG operating system versions 4.8 and prior can b…9.8
• CVE-2023-3113An unauthenticated XML external entity injection (XXE) vulne…7.5
• CVE-2023-31130c-ares is an asynchronous resolver library. ares_inet_net_pt…6.4
• CVE-2023-31131Greenplum Database (GPDB) is an open source data warehouse b…9.1