{"id":"CVE-2026-96677","aliases":[],"cve":{"records":[{"id":"CVE-2026-96677","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-23T15:24:35.832Z","published":"2026-11-05T11:54:38.096Z","modified":"2026-11-05T11:54:38.096Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-05T11:54:38.096Z"}],"references":[{"url":"https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome","titleSource":"apache","descriptionSource":"apache","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.\n\nHTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","score":10,"severity":"critical","published":"2026-11-05T11:54:38.096Z","modified":"2026-11-05T11:54:38.096Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Juneau","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.2.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.juneau/juneau-marshall","packageIdentity":{"ecosystem":"Maven","name":"org.apache.juneau:juneau-marshall"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-96677"}],"remediation":[],"references":["https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6"],"sources":[{"name":"CVE","id":"CVE-2026-96677","modified":"2026-11-05T11:54:38.096Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96677"}],"assessments":[{"source":"apache","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10}],"sourceAffected":[],"observedAt":"2026-11-05T12:44:36.772Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:00:33.112Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T12:55:44.547Z","attemptedAt":"2026-11-05T12:55:44.547Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-05T12:55:35.478Z","attemptedAt":"2026-11-05T12:55:35.478Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-05T12:55:34.531Z","attemptedAt":"2026-11-05T12:55:34.531Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T12:55:34.046Z","attemptedAt":"2026-11-05T12:55:34.046Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-c66v-m2x5-fxxr","url":"https://github.com/advisories/GHSA-c66v-m2x5-fxxr","modified":"2026-11-05T12:32:20Z","checkedAt":"2026-11-05T12:55:35.478Z"},{"source":"NVD","id":"CVE-2026-96677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96677","modified":"2026-11-05T12:17:51.620","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-05T12:55:44.547Z"}],"aiSummary":{"text":"Apache Juneau through 9.2.0 has a cross-site scripting vulnerability due to unescaped request variables in HTML document serialization. An attacker with access to the application's chrome can inject malicious code. The impact is limited to applications that include request-derived variables in their chrome.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T12:46:10.881Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96677"}]}}