Cross-site scripting in Apache Allura code display (CVE-2026-73238)

Apache Allura contains a cross-site scripting (XSS) vulnerability in its code display functionality. This issue could allow attackers to inject and execute malicious scripts in the context of affected users' browsers. Affected versions: - Apache Allura before 1.19.1 We recommend updating to: 1.19.1. CVSS ? · our assessment: act_now Reference: https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk Details: https://vuln.today/cve/CVE-2026-73238