{"id":"UBUNTU-CVE-2026-120421","details":"In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.","modified":"2026-11-06T01:00:35.464364835Z","published":"2026-11-05T00:00:00Z","upstream":["CVE-2026-120421"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-120421"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-120421"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}],"affected":[{"package":{"name":"mojarra","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-1","2.2.8-2"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.8-2","binary_name":"libjsf-api-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-3","2.2.8-4","2.2.8-5"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.8-5","binary_name":"libjsf-api-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libjsf-api-java","binary_version":"2.2.8-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-6"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.8-6","binary_name":"libjsf-api-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libjsf-api-java","binary_version":"2.2.8-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-6build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjsf-api-java","binary_version":"2.2.8-6build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}},{"package":{"name":"mojarra","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/mojarra?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-6","2.2.8-6build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjsf-api-java","binary_version":"2.2.8-6build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120421.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}