Apache Shiro principal tags before 3.0.2 allow XSS (CVE-2026-129320)
Original title: CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting
Apache rates the flaw CVSS 4.0 2.1; it needs low privileges and user interaction.
Lenny Primak posted that shiro:principal tags in Apache Shiro did not escape output, which could allow cross-site scripting. Affected packages are shiro-web before 3.0.2 and shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2. The tags cover Jakarta Pages and Jakarta Faces. Apache scores the issue CVSS 4.0 2.1, low.
- CVSS 4.0 vector rates confidentiality and integrity impacts as low on subsequent systems.
- shiro-web before 3.0.2 is affected.
- shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 is affected.
- The note was posted on November 13.
Impact: cross-site scripting through unescaped principal tag output
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro shiro-web | before 3.0.2 | 3.0.2 |
| Apache Shiro shiro-jakarta-ee | 2.0.0-alpha-0 before 3.0.2 | 3.0.2 |
- 1.Upgrade shiro-web and shiro-jakarta-ee to 3.0.2.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-129320 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 2. 1 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.