CVE-2026-96677 · Package
NO FIX YET · SEE WHAT TO DO
Apache Juneau's HTML serializer does not HTML-encode variable substitutions in page chrome such as header, nav, aside and footer. An attacker can inject script into a page when the application puts request headers, form data or path values into that chrome, so the script runs in a victim's browser.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only applications that use Apache Juneau's HTML serialization and add request-derived variables (request headers, form data or path values) to the page chrome are exposed. Applications using the default chrome, or not serving HTML through Juneau, can skip it.
Not affected if default-chrome, no-html-serializer, no-request-variables-in-chrome
Who cares apache-juneau, html-serialization, java, rest-api
9.2.0 or earlier is affected.9.2.1.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.
HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.