XWiki Rendering converts textual input in various syntaxes into other formats such as XHTML. Before versions 14.10.2 and 15.0 RC1, any user able to edit their own user profile or other documents could inject arbitrary script macros (Groovy, Python) via unescaped rendering output included inside HTML macros. This improper neutralization of directives in dynamically evaluated code (CWE-95) allows remote code execution with full programming rights, including unrestricted read/write access to all wiki content. The vulnerability arises because rendering output can close the HTML macro and inject executable script macros. The vendor patched this by ensuring rendering output cannot close the HTML macro boundary, thus preventing injection. A partial workaround involves adding escaping where rendering output is used, but no exhaustive list of such locations is available.

Successful exploitation allows an attacker with edit permissions to execute arbitrary code remotely with programming rights, resulting in full read and write access to all wiki contents. This compromises confidentiality, integrity, and availability of the wiki system. The CVSS score of 9.9 reflects critical impact with network attack vector, low attack complexity, and no user interaction required.

An official fix is available in xwiki-rendering versions 14.10.2 and 15.0 RC1 that prevents rendering output from closing HTML macros and injecting script macros. Users should upgrade to at least version 14.10.2 or later. A workaround involving escaping rendering output in wiki documents is possible but incomplete due to lack of a comprehensive list of affected locations. No cloud service remediation applies as this is not a cloud service.