TabberNeue is a MediaWiki extension

CVE-2025-21612 is an XSS flaw in the TabberNeue MediaWiki extension's TabberTransclude path. In versions >= 1.9.1 and < 2.7.2, the extension prints an invalid transcluded page name into an HTML error block without escaping it, so a crafted pageName inside <tabbertransclude> can inject script into the rendered wiki page. The vendor fix landed in commit f229cab and shipped in release 2.7.2 on 2025-01-04; the CVE was disclosed on 2025-01-06.

The vendor's 8.6 HIGH score overrates real-world enterprise risk because the CVSS assumes pure unauthenticated network reachability with no user interaction, while the practical chain usually requires the attacker to be able to edit wiki content or otherwise cause crafted wikitext to be rendered in a TabberNeue-enabled wiki. That makes this a *post-exposure content-authoring abuse case*, not a broad internet worm path. It still matters because successful stored XSS against a wiki can target privileged editors and admins, but the reachable population is much narrower than the score suggests.

Why this verdict

• Downward pressure: requires attacker content position in most real deployments. The advisory says exploitation comes from users who can edit pages or otherwise render wikitext; that usually implies authenticated contributor access or a permissive anonymous-edit wiki, not arbitrary internet reachability.
• Downward pressure: narrow product and feature population. This is not core MediaWiki; it is a third-party extension, and the vulnerable sink is in the TabberTransclude path specifically, so only a subset of MediaWiki estates are even candidates.
• Downward pressure: no KEV, no active-campaign evidence, very low EPSS. With no known in-the-wild exploitation signal and a low predicted exploitation probability, there is no intel amplifier justifying a HIGH bucket.
• Upward pressure: stored XSS can still hit admins. If an attacker can plant the payload and lure a privileged wiki user to the page, same-origin script execution can steal session context or drive admin actions inside the wiki.

Why not higher?

It is not higher because the attack chain compounds several real-world prerequisites: the target must run a niche extension, the vulnerable transclusion mode must be present, and the attacker usually needs page-edit capability or another route to render crafted wikitext. That is meaningful friction for an enterprise patch queue. The absence of KEV listing, public exploit tooling, or active exploitation telemetry removes the main reasons to keep this in HIGH.

Why not lower?

It is not lower because stored XSS on a collaboration platform can still become account takeover or privileged action execution when an admin views the page. In organizations where documentation wikis are integrated with SSO and have high-trust admin sessions, the blast radius is limited but not trivial.

1. Restrict who can edit pages using TabberNeue — Limit edit rights for namespaces or groups that can publish <tabbertransclude> content, and do it immediately as an administrative control while you work the fix. For a MEDIUM verdict there is no formal noisgate mitigation SLA, but this is the cleanest exposure reducer because it removes the attacker's authoring position.
2. Add AbuseFilter or content linting rules — Create a rule to flag or block new <tabbertransclude> entries containing suspicious title strings, HTML metacharacters, or obvious XSS probes. This is useful as a temporary control and should be deployed as soon as your wiki admins can safely test it.
3. Review recent page revisions for the tag — Search for pages containing <tabbertransclude> and inspect recent edits for invalid titles or payload-like strings. Do this during the same remediation cycle so you are not just patching forward while leaving stored payloads in content.
4. Enable or tighten CSP reporting on the wiki — A browser Content-Security-Policy with reporting will not guarantee prevention, but it improves visibility into attempted script execution from poisoned pages. Roll this out carefully to avoid breaking legitimate wiki features and use it for detection rather than as your only control.

Run this on the MediaWiki application host where the TabberNeue extension files are installed. Invoke it as bash check-tabberneue-cve-2025-21612.sh /var/www/mediawiki/extensions/TabberNeue; read access to the extension directory is enough, root is not required.

#!/usr/bin/env bash
# check-tabberneue-cve-2025-21612.sh
# Detect CVE-2025-21612 in MediaWiki TabberNeue by inspecting the vulnerable sink.
# Usage: bash check-tabberneue-cve-2025-21612.sh /path/to/extensions/TabberNeue
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

EXT_DIR="${1:-}"
if [[ -z "$EXT_DIR" ]]; then
  echo "UNKNOWN: missing argument. Usage: $0 /path/to/extensions/TabberNeue"
  exit 2
fi

TARGET="$EXT_DIR/includes/TabberTransclude.php"
if [[ ! -f "$TARGET" ]]; then
  echo "UNKNOWN: file not found: $TARGET"
  exit 2
fi

# Patched sink from commit f229cab:
#   Sanitizer::escapeHtmlAllowEntities( $pageName )
# Vulnerable sink:
#   sprintf( '<div class="error">Invalid title: %s</div>', $pageName );

if grep -Fq "Sanitizer::escapeHtmlAllowEntities( \$pageName )" "$TARGET"; then
  echo "PATCHED: escaping sink present in $TARGET"
  exit 0
fi

if grep -Fq "<div class=\"error\">Invalid title: %s</div>', \$pageName" "$TARGET"; then
  echo "VULNERABLE: unescaped Invalid title sink present in $TARGET"
  exit 1
fi

# Fallback heuristics in case formatting differs.
if grep -Fq "Invalid title: %s" "$TARGET"; then
  if grep -Fq "escapeHtmlAllowEntities" "$TARGET"; then
    echo "PATCHED: invalid-title sink exists but escaping helper is present"
    exit 0
  fi
  echo "UNKNOWN: invalid-title sink found, but could not confirm escaping state"
  exit 2
fi

echo "UNKNOWN: expected sink pattern not found; file may be heavily modified or from an unsupported branch"
exit 2

Sources

1. NVD CVE-2025-21612
2. GitHub Security Advisory GHSA-4x6x-8rm8-c37j
3. Vulnerable introducing commit d8c3db4
4. Fixing commit f229cab
5. Release v2.7.2
6. MediaWiki extension page for TabberNeue
7. CISA Known Exploited Vulnerabilities Catalog
8. GitLab advisory database entry