CVE-2026-120421

MediumCVSS 6.1

Published: 04/11/2026(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Summary

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

Risk Assessment

An attacker could conduct an XSS attack by executing arbitrary JavaScript in the victim's browser, potentially leading to session or data theft. CSP bypass is possible.

Recommendation

Update Eclipse Mojarra to a version containing the fix. Consider disabling URL client window mode if not required.

Other vulnerabilities in Eclipse Mojarra

CVE-2026-46581High
In Eclipse Mojarra versions 2.3 and later, URL handling in DefaultFaceletFactory does not block remote URLs, allowing an attacker to include a remote Facelet processed with server privileges.

Original NVD description (English source)

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS