{"affected":[{"product":"xwiki-pro-macros","source":"CNA: GitHub_M","vendor":"xwikisas","versions":[{"status":"affected","version":">= 1.13, < 1.14.5"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"com.xwiki.pro:xwiki-pro-macros","product":"com.xwiki.pro:xwiki-pro-macros","source":"OSV GHSA-w56x-9778-rppx","vendor":"","versions":[{"events":[{"introduced":"1.13"},{"fixed":"1.14.5"}],"status":"unknown","version":"1.13","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-44179","cwes":["CWE-95"],"description":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.","epss":{"date":"2026-11-02","percentile":0.5281,"score":0.0069},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"}],"kev":null,"metrics":[{"score":9.9,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793650788008,"publishedAt":1793201745630,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-w56x-9778-rppx"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-w56x-9778-rppx"}],"remediation":[{"kind":"fix","source":"OSV GHSA-w56x-9778-rppx","text":"com.xwiki.pro:xwiki-pro-macros (Maven): OSV reports a fixed version 1.14.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-w56x-9778-rppx"}],"revision":"544eb433272593020efd9dcf24d8051094a76bad448d797a1790b5d9b1871777","sources":[{"modifiedAt":1793650788008,"name":"CNA: GitHub_M","retrievedAt":1793653798644,"url":"https://www.cve.org/CVERecord?id=CVE-2026-44179"},{"modifiedAt":1782159988565,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653800931,"url":"https://osv.dev/vulnerability/GHSA-w56x-9778-rppx"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653808967,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44179"}],"ssvc":{"assessedAt":1793650731649,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"XWiki Pro Macros: excerpt-include title and content injection executes code","updatedAt":1793653808967}