### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page. ### Details The title of the included page isn't escaped in [ExcerptInclude.xml#L277](https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml#L277). Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights. ### PoC 1. As a user without script or programming right, create a page named `Exploit`. 2. In the edit screen, change the title to `{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}`. 3. Set the content to ``` {{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}} {{excerpt}} {{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}} {{/excerpt}} ``` 4. Save and view the page. 5. If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded. ### Impact Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page. ### Details The title of the included page isn't escaped in [ExcerptInclude.xml#L277](https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml#L277). Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights. ### PoC 1. As a user without script or programming right, create a page named `Exploit`. 2. In the edit screen, change the title to `{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}`. 3. Set the content to ``` {{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}} {{excerpt}} {{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}} {{/excerpt}} ``` 4. Save and view the page. 5. If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded. ### Impact Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
Update com.xwiki.pro:xwiki-pro-macros to 1.14.5 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanxwiki-pro-macros has remote code execution from page title and content via excerpt-include macro affects com.xwiki.pro:xwiki-pro-macros (maven). Severity is critical. ### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page. ### Details The title of the included page isn't escaped in [ExcerptInclude.xml#L277](https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml#L277). Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights. ### PoC 1. As a user without script or programming right, create a page named `Exploit`. 2. In the edit screen, change the title to `{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}`. 3. Set the content to ``` {{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}} {{excerpt}} {{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}} {{/excerpt}} ``` 4. Save and view the page. 5. If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded. ### Impact Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| com.xwiki.pro:xwiki-pro-macrosmaven | >=1.13,<1.14.5 | 1.14.5 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate com.xwiki.pro:xwiki-pro-macros to 1.14.5 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanxwiki-pro-macros has remote code execution from page title and content via excerpt-include macro affects com.xwiki.pro:xwiki-pro-macros (maven). Severity is critical. ### Summary The excerpt-include macro does not properly escape the title of the included page and executes the content of the excerpt with the macro's rights. Therefore, it is vulnerable to XWiki syntax injection via the included page's title and content, allowing remote code execution for any user who can edit a page. ### Details The title of the included page isn't escaped in [ExcerptInclude.xml#L277](https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml#L277). Further, the content of the excerpt macro is rendered to XWiki syntax and output into the macro's content such that it is executed with the macro's rights. ### PoC 1. As a user without script or programming right, create a page named `Exploit`. 2. In the edit screen, change the title to `{{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}`. 3. Set the content to ``` {{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}} {{excerpt}} {{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}} {{/excerpt}} ``` 4. Save and view the page. 5. If this displays "Hello from Groovy Title!" without the surrounding macro code or "Hello from Groovy content!", the attack succeeded. ### Impact Remote code execution impacts the confidentiality, integrity and availability of the whole XWiki installation.
AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| com.xwiki.pro:xwiki-pro-macrosmaven | >=1.13,<1.14.5 | 1.14.5 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard