CVE-2025-53093: TabberNeue Stored XSS Vulnerability in StarCitizenTools Package
Summary
CVE-2025-53093: TabberNeue vulnerable to Stored XSS through wikitext. Affects starcitizentools/tabber-neue versions >= 3.0.0, < 3.1.1. Fixed in 3.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TabberNeue is a MediaWiki extension designed to enhance the user experience by allowing the creation of tabbed content. It enables users to organize information into tabs, making it easier to navigate complex data. However, the extension has a vulnerability that allows arbitrary HTML to be inserted into the DOM, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from insufficient validation of attributes in the <tabber> tag. Specifically, the attributes provided in wikitext are not properly escaped before being inserted into the HTML, allowing attackers to inject malicious scripts. This can lead to stored cross-site scripting (XSS) attacks, where arbitrary JavaScript can be executed in the context of the user's browser, potentially compromising user data and session integrity.
How To Fix
Minimum fixed version
3.1.1
This is the first release that contains the fix.
composer require starcitizentools/tabber-neue:3.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the <tabber> tag with user-generated content until the package is updated. Additionally, ensure that user input is sanitized and validated before being processed.
Conclusion
The TabberNeue extension for MediaWiki has a critical stored XSS vulnerability that can be exploited through improperly validated attributes. Users are advised to update to the latest version to mitigate risks and ensure the security of their applications.
See every vulnerability recorded for starcitizentools/tabber-neue →
FAQ
The vulnerability allows for stored XSS attacks through the improper handling of attributes in the <tabber> tag.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The potential impacts include unauthorized script execution, data theft, and session hijacking, which can compromise user security.
Yes, a patch is available in version 3.1.1 of the TabberNeue package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for starcitizentools/tabber-neue.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
