A critical remote code execution vulnerability in XWiki Rendering allows authenticated users to execute arbitrary scripts, granting them full read and write access to all wiki contents.

This flaw involves improper neutralization of directives in dynamically evaluated code (CWE-95), where rendering output is insufficiently escaped within HTML macros. Any authenticated user with document editing privileges can close the intended HTML macro and inject malicious Groovy or Python scripts that execute with elevated programming rights.

The potential for remote code execution poses an extreme risk to organizational data integrity and confidentiality. An attacker could gain total control over the wiki environment, leading to the exfiltration of sensitive information, unauthorized modification of documentation, or the deployment of persistent backdoors. Given the CVSS score of 9.9, this vulnerability is classified as critical and requires immediate remediation to prevent complete system compromise.

Immediate Action: Update XWiki Rendering to version 14.10.2 or 15.0 RC1 immediately to implement the required output escaping that prevents macro injection.

Proactive Monitoring: Review audit logs for unusual document edit activities or the creation of suspicious wiki pages containing script macros, particularly those invoking Groovy or Python.

Compensating Controls: If immediate patching is not feasible, restrict the ability of standard users to edit documents or their own profiles until the update can be applied.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the ease of exploitation for authenticated users, demands an immediate response. Security teams must prioritize patching XWiki Rendering to the specified fixed versions to neutralize the risk of remote code execution. Failure to act promptly could result in the total compromise of the wiki instance and all hosted data.