Loading vulnerability…
Reflected cross-site scripting in Apache Juneau HTML page chrome
CVE-2026-96677 is a reflected cross-site scripting vulnerability in Apache Juneau's juneau-marshall module through version 9.2.0. HTML document serialization fails to HTML-encode request-derived variable substitutions in HtmlDocConfig page-chrome fields, including header, nav, aside, footer, head, and no-results content. Applications that interpolate RQ, RH, RF, or RP variables into these fields can reflect attacker-controlled request values as active HTML or script. Script and style chrome fields can also interpolate raw request data. Default page chrome does not interpolate request variables and is not affected; article-body substitutions already receive encoding.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can execute JavaScript in a victim's browser within the affected application's origin. Depending on browser protections and the victim's privileges, this can expose application data accessible to scripts, permit actions using the victim's authenticated session, or alter displayed content. The vulnerability does not establish server-side code execution.
If you can’t patch tonight, do this now.
Until upgrading, remove request-derived RQ, RH, RF, and RP substitutions from HtmlDocConfig chrome fields, including script and style fields. If request-derived values must appear in HTML chrome, ensure they are appropriately encoded for their output context before inclusion. Applications retaining default chrome without request-derived substitutions are not affected.
Patch, then assume compromise.
Upgrade Apache Juneau juneau-marshall and any shaded or aggregate artifacts embedding the affected module to version 9.2.1. This release HTML-encodes HTML-chrome substitutions except the developer passthrough variables W, C, and RS, and leaves request variables unresolved in script and style fields.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.