AIKIDO-2026-498469

starcitizentools/tabber-neue is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-9cj7-4vh9-4x83 Published Aug 3, 2026

High Risk

This Affects:

starcitizentools/tabber-neue

3.0.0 - 4.0.1

Fixed in 4.0.2

Are you affected? Scan for Free

TL;DR

The Tabs template in this MediaWiki extension emits tab and tab-panel ID attribute values using Mustache unescaped triple-brace output. A tab label is used to build those element IDs, and the ID sanitization does not escape double quotes, so a label containing a quote can close the attribute and inject arbitrary HTML attributes, including event handlers, onto the rendered tab and panel elements. Any user who can edit a page can store a payload that runs JavaScript in the browser of any reader who views the page, enabling session or cookie theft. The fix changes both attribute loops to HTML-escaped output so label-derived IDs can no longer break out of the attribute context.

Who does this affect?

You are affected if you are running a version within the vulnerable range and your wiki lets users create pages that use the tabbertransclude tag. No configuration change mitigates this: the default (disabled) $wgTabberNeueParseTabName state is affected, and the panel-attribute sink is unescaped in every 3.x and 4.x release before 4.0.2. Plain tabber tags are not exploitable by this vector.