Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Apache Juneau may execute malicious scripts from user input

CVE-2026-96677 · published 4 days ago
Summary

Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can affect any site that displays user‑provided values in its layout. Upgrade to version 9.2.1 to stop the problem.

What to do
  • Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
VendorProductAffected versions
apache software foundation apache juneau < 9.2.1
Original advisory text
Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.

HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-96677 · NVD
CVE-2026-96677 · MITRE
Track software like this
Free during beta