{"id":"CVE-2026-96677","kind":"vulnerability","aliases":["CVE-2026-96677"],"related":[],"title":"Apache Juneau: HTML page chrome reflects request values unencoded, enabling XSS","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.\n\nHTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","summary":"Apache Juneau's HTML serializer does not HTML-encode variable substitutions in page chrome such as header, nav, aside and footer. An attacker can inject script into a page when the application puts request headers, form data or path values into that chrome, so the script runs in a victim's browser.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","html-serialization","java","package","rest-api"],"not_affected_if":["default-chrome","no-html-serializer","no-request-variables-in-chrome"],"how_to_check":"- Look for chrome or header/nav/aside/footer settings in the application that reference request headers, form fields or path variables, for example in the Juneau HTML serializer configuration.\n- Check the Juneau version in the project's build file: `9.2.0` or earlier is affected.\n- The default chrome does not use request variables, so an application running the default is not exposed.","fix":"- Apache Juneau: upgrade to `9.2.1`.","status":"open","published_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:48+00:00","triaged_at":"2026-11-05T12:40:00+00:00","updated_at":"2026-11-05T12:40:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T12:40:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.","reach":"internet","title":"Apache Juneau: HTML page chrome reflects request values unencoded, enabling XSS","impact":"medium","summary":"Apache Juneau's HTML serializer does not HTML-encode variable substitutions in page chrome such as header, nav, aside and footer. An attacker can inject script into a page when the application puts request headers, form data or path values into that chrome, so the script runs in a victim's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-juneau","java","rest-api","html-serialization"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in victims' browsers, session tokens may be stolen","analyst_note":"","how_to_check":"- Look for chrome or header/nav/aside/footer settings in the application that reference request headers, form fields or path variables, for example in the Juneau HTML serializer configuration.\n- Check the Juneau version in the project's build file: `9.2.0` or earlier is affected.\n- The default chrome does not use request variables, so an application running the default is not exposed.","plain_action":"","needs_analyst":false,"not_affected_if":["default-chrome","no-html-serializer","no-request-variables-in-chrome"],"who_is_affected":"Only applications that use Apache Juneau's HTML serialization and add request-derived variables (request headers, form data or path values) to the page chrome are exposed. Applications using the default chrome, or not serving HTML through Juneau, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":4346,"output_tokens":586,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96677':14A,17A '9.2.0':167C '9.2.1':175C 'add':157C 'affect':160C,163C 'allow':140C 'apach':1A,19B,29B,96C,164C 'apache-juneau':18B 'api':28B 'applic':61B,119C,155C 'asid':48B,114C 'attack':52B 'browser':81B 'chrome':5A,43B,72B,111C,121C,147C 'cross':91C,142C 'cross-sit':90C,141C 'cve':12A,15A 'data':66B,132C 'default':146C 'deriv':125C 'document':99C 'enabl':10A 'encod':38B,105C 'field':118C 'fix':177C 'footer':50B,115C 'form':65B,131C 'generat':89C 'header':46B,64B,112C,130C 'html':3A,22B,32B,37B,98C,104C 'html-encod':36B,103C 'html-serial':21B 'improp':82C 'includ':122C 'inject':54B 'input':85C 'issu':162C,179C 'java':24B 'juneau':2A,20B,30B,97C,165C 'nav':47B,113C 'neutral':83C 'packag':25B 'page':4A,42B,58B,88C,110C 'path':68B,134C 'put':62B 'recommend':170C 'reflect':6A,136C 'request':7A,63B,124C,129C,151C 'request-deriv':123C 'rest':27B 'rest-api':26B 'run':76B 'script':55B,75B,93C,144C 'serial':23B,33B,100C 'similar':117C 'site':92C,143C 'substitut':40B,107C 'unencod':9A,139C 'upgrad':172C 'use':150C 'user':168C 'valu':8A,69B,135C,138C 'variabl':39B,106C,126C,152C 'version':174C 'victim':79B 'vulner':94C 'web':87C 'whose':120C 'xss':11A","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Apache Juneau's HTML serialization and add request-derived variables (request headers, form data or path values) to the page chrome are exposed. Applications using the default chrome, or not serving HTML through Juneau, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","htmlserialization","java","package","restapi"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96677","severity":null,"published_at":"2026-11-05T12:17:51+00:00","modified_at":"2026-11-05T12:17:51+00:00","first_seen_at":"2026-11-05T12:38:48+00:00","fetched_at":"2026-11-05T12:38:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}