Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96677— Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

Quick assessment

Affected
Apache Software Foundation Apache Juneau
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Juneau 中存在“网页生成期间输入未正确中和（跨站脚本攻击，XSS）”漏洞。 在 HTML 文档序列化过程中，页面框架（chrome，包括页眉、导航栏、侧边栏、页脚等区域）中的变量替换未进行 HTML 编码。若应用的框架中包含了源自请求的变量（例如请求头、表单数据或路径值），这些值将以未编码的形式被反射到页面中，从而引发跨站脚本攻击。由于默认框架并未使用请求变量，因此仅当应用自行添加了此类变量时才会受到影响。 该漏洞影响 Apache Juneau 9.2.0 及更早版本。 建议用户升级至 9.2

CVSS 10.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96677

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Juneau 0 ~ 9.2.1 -

II. Public POCs for CVE-2026-96677

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96677

请登录查看更多情报信息。

Other References for CVE-2026-96677 (1)

Same Patch Batch · Apache Software Foundation · 2026-11-05 · 42 CVEs total

CVE-2026-73098 10.0 CRITICAL Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa
CVE-2026-73099 10.0 CRITICAL Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body
CVE-2026-73100 10.0 CRITICAL Apache Juneau: Sensitive request headers logged in cleartext by the default request logger
CVE-2026-73101 10.0 CRITICAL Apache Juneau: Internal exception class and message disclosed via error response header an
CVE-2026-73116 10.0 CRITICAL Apache Juneau: REST client forwards credentials to a different origin when following HTTP
CVE-2026-73117 10.0 CRITICAL Apache Juneau: Response header CRLF injection and open redirect when applications set head
CVE-2026-121489 10.0 CRITICAL Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config
CVE-2026-73095 8.7 HIGH Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque
CVE-2026-109837 Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr
CVE-2026-109129 Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un
CVE-2026-109856 Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal
CVE-2026-109928 Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables
CVE-2026-114229 Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execut
CVE-2026-114233 Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modific
CVE-2026-114235 Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modific
CVE-2026-114271 Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables C
CVE-2026-114272 Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables
CVE-2026-114277 Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Ac
CVE-2026-103866 Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, ena
CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Showing top 20 of 42 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Juneau
Same vendor: Apache Software Foundation
Same weakness: CWE-79