How to fix CVE-2025-53093?

Within 7 days: Identify all affected systems running version 3.0.0 and and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Is TabberNeue affected by CVE-2025-53093?

Organizations using version 3.0.0 and face significant risk from CVE-2025-53093, a cross-site scripting vulnerability rated CVSS 8.6. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users.

TabberNeue CVE-2025-53093

EUVD-2025-19418 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-27 [email protected]

GHSA-jfj7-249r-7j2m

XSS

8.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19418

CVE Published

Jun 27, 2025 - 18:15 nvd

HIGH 8.6

DescriptionNVD

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the <tabber> tag. Version 3.1.1 contains a patch for the bug.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

CVE-2025-53093 vulnerability details – vuln.today

Back