AIKIDO-2026-498469

starcitizentools/tabber-neue is vulnerable to Cross-Site Scripting (XSS)

CVE-2026-115879Published Aug 3, 2026

CVE Score

High

Cross-Site Scripting (XSS)

TL;DR

The Tabs template in this MediaWiki extension emits tab and tab-panel ID attribute values using Mustache unescaped triple-brace output. A tab label is used to build those element IDs, and the ID sanitization does not escape double quotes, so a label containing a quote can close the attribute and inject arbitrary HTML attributes, including event handlers, onto the rendered tab and panel elements. Any user who can edit a page can store a payload that runs JavaScript in the browser of any reader who views the page, enabling session or cookie theft. The fix changes both attribute loops to HTML-escaped output so label-derived IDs can no longer break out of the attribute context.

How do I fix this?

Upgrade the starcitizentools/tabber-neue library to the patch version.

Who does this affect?

You are affected if you are running a version within the vulnerable range and your wiki lets users create pages that use the tabbertransclude tag. No configuration change mitigates this: the default (disabled) $wgTabberNeueParseTabName state is affected, and the panel-attribute sink is unescaped in every 3.x and 4.x release before 4.0.2. Plain tabber tags are not exploitable by this vector.