Description
HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.
Published: 2026-06-05
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A reflected cross‑site scripting flaw (CWE‑79) exists in the search center of HCL Digital Experience Compose. The flaw allows an attacker to embed arbitrary JavaScript into the victim’s browser when a crafted search request is processed, enabling malicious code execution within the client context.

Affected Systems

The vulnerability affects the HCL Digital Experience Compose component from HCLSoftware. No specific version numbers are listed, so all installations may be susceptible until a patch is applied.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is currently unavailable, so the current exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that a user visit a maliciously crafted URL in the search center; no authentication is required, and it is entirely client‑side, making it straightforward to test and deploy.

Generated by OpenCVE AI on June 5, 2026 at 07:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest HCL Digital Experience Compose patch that eliminates the reflected XSS flaw, as published by HCL Support.
  • If an update cannot be applied immediately, block or remove the search center functionality from external access or enforce strict URL encoding and HTML entity escaping on all user‑supplied search inputs to prevent script injection.
  • Enforce a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, providing an additional defensive layer against XSS execution.

Generated by OpenCVE AI on June 5, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Hcltech
Hcltech dx Compose
Vendors & Products Hcltech
Hcltech dx Compose

Fri, 05 Jun 2026 06:45:00 +0000

Type Values Removed Values Added
Description HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.
Title HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Hcltech Dx Compose
cve-icon MITRE

Status: PUBLISHED

Assigner: HCL

Published:

Updated: 2026-06-05T06:03:11.053Z

Reserved: 2026-01-05T16:08:22.254Z

Link: CVE-2026-21825

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-05T07:16:29.707

Modified: 2026-06-05T16:05:36.550

Link: CVE-2026-21825

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T10:07:02Z

Weaknesses