Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84164— Stored XSS in the static HTML report export, because json.dumps does not escape the markup character

Quick assessment

Affected
Ericsson CodeChecker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

由 、 以及 生成的 HTML 报告，会通过 将报告消息、检查器名称和源代码文件路径放入一个 块中。由于 不会转义小于号（ ），因此若上述三个字段中的任意一个包含闭合的 标签，就会导致该 元素提前结束，其后的内容将被解析为 HTML。 输入数据的来源可能是受控于被分析代码树的人员、 所导入的第三方结果文件，或在 流程中持有 的人员。报告的查看者则是其他人员。文档 中记录了将报告写入 Jenkins 的 目录并将其 URL 发布到 Gerrit 审查中的操作。需要特别指出的是，Jenkins 在提供 内容时采用了严格

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84164

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stored XSS in the static HTML report export, because json.dumps does not escape the markup character
Source: CVE Program / CVE List V5
Vulnerability Description
The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Ericsson CodeChecker 0 ~ 6.29.3 -

II. Public POCs for CVE-2026-84164

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84164

请登录查看更多情报信息。

Other References for CVE-2026-84164 (1)

Same Patch Batch · Ericsson · 2026-11-06 · 3 CVEs total

CVE-2026-84155 5.3 MEDIUM Session Token Remains Valid After Logout in Multi-Worker Deployments
CVE-2026-84161 4.9 MEDIUM Authenticated remote denial of service through unbounded zlib decompression in storeAnalys

IV. Related Vulnerabilities

Same product: CodeChecker
Same vendor: Ericsson
Same weakness: CWE-79