Apache Juneau CVE-2026-96677

Not exploitable in default configurations: the advisory states default chrome does not interpolate the request-derived variables. The specific prerequisite is that the application developer has placed a request-derived Simple Variable Language variable (RQ, RH, RF, or RP) into an HTML-format HtmlDocConfig chrome field - specifically aside, header, footer, nav, head, or the no-results message. Script and style chrome fields could likewise interpolate these variables as raw text. Exploitation additionally requires victim interaction, since the attacker-controlled request value must be reflected back to a user's browser. Limiting factors: non-default opt-in configuration, the article body was already encoded (so it is unaffected), and the developer-passthrough variables W, C, and RS are out of scope of the fix. The only complete remediation per the vendor is upgrading to 9.2.1; the interim mitigation is to remove RQ, RH, RF, and RP from HtmlDocConfig chrome fields.

Real-world risk is low-to-moderate and clearly bounded by preconditions. The vendor (ASF) rates this 'moderate'; no CVSS vector, EPSS score, KEV listing, or PoC is present in the input, and vuln.today's decision label is 'awaiting_data' - so no signal here supports treating it as urgent, and none contradicts the moderate rating. Critically, the flaw is not present in default configurations: the advisory states default chrome does not interpolate the request-derived variables (RQ, RH, RF, RP), and exploitation requires an application developer to have placed one of those variables into an HTML-format HtmlDocConfig chrome field (aside, header, footer, nav, head, or the no-results message). This is a reflected cross-site scripting issue, so it also requires victim interaction (visiting an attacker-crafted request). No CVSS vector was supplied by NVD or the vendor (CVSS Score/Vector: N/A), so the vector below is independently assessed, not copied. Net: this is a genuine but conditional XSS affecting only opted-in configurations of a niche framework, not a high-urgency widespread-exploitation scenario.

An application built on Juneau has configured an HtmlDocConfig HTML-format chrome field (e.g. header or aside) to interpolate a request-derived variable such as RQ. An attacker crafts a request whose reflected value contains markup, then lures a victim into issuing that request (e.g. via a malicious link); the value is written into the generated HTML page without encoding and executes as script in the victim's browser. No public exploit code is identified at time of analysis.