---
id: "CVE-2026-96677"
kind: "vulnerability"
aliases: ["CVE-2026-96677"]
title: "Apache Juneau: HTML page chrome reflects request values unencoded, enabling XSS"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-juneau", "html-serialization", "java", "package", "rest-api"]
not_affected_if: ["default-chrome", "no-html-serializer", "no-request-variables-in-chrome"]
published_at: "2026-11-05T12:17:51+00:00"
first_seen_at: "2026-11-05T12:38:48+00:00"
updated_at: "2026-11-05T12:40:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96677", "first_seen_at": "2026-11-05T12:38:48+00:00"}]
exploit_sources: []
---

# Apache Juneau: HTML page chrome reflects request values unencoded, enabling XSS

Apache Juneau's HTML serializer does not HTML-encode variable substitutions in page chrome such as header, nav, aside and footer. An attacker can inject script into a page when the application puts request headers, form data or path values into that chrome, so the script runs in a victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for chrome or header/nav/aside/footer settings in the application that reference request headers, form fields or path variables, for example in the Juneau HTML serializer configuration.
- Check the Juneau version in the project's build file: `9.2.0` or earlier is affected.
- The default chrome does not use request variables, so an application running the default is not exposed.

## Fix

- Apache Juneau: upgrade to `9.2.1`.

## Timeline

- 2026-11-05T12:38:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96677

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.

HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_