Improper Neutralization of Input During Web Page Generation allows an attacker who can control request parameters to inject malicious script into the HTML serialised by Apache Juneau. The vulnerability occurs because the page chrome, such as header or footer, incorporates request-derived variables without performing HTML escaping. The reflected payload can execute arbitrary JavaScript in the context of the victim's browser, potentially hijacking sessions or exfiltrating data. This is a classic Cross‑Site Scripting flaw and is assigned a CVSS score of 10, indicating that exploitation can fully compromise confidentiality, integrity, and availability of the web application for affected users.

Apache Software Foundation’s Apache Juneau library is affected through version 9.2.0. Applications built with Juneau that expose the HTML document chrome (header, navigation, aside, footer, etc.) and include request-derived variables in those sections are susceptible to this flaw. The default chrome configuration does not use request variables, so the risk only applies to custom or modified configurations that reference request data.

The flaw is rated as critical with a base CVSS score of 10. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the XSS by sending a specially crafted HTTP request that contains malicious payloads in headers, form data, or path segments that are later reflected into the unescaped page chrome. As the exploit does not require prior authentication, any user who visits the impacted page can be affected, making this a high‑impact, easily exploitable vulnerability.