International
The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · low · CVSS 2.1

Apache Shiro XSS via unescaped principal tags in Jakarta Pages and Faces (CVE-2026-129320)

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Apache Shiro users with principal tags in Jakarta Pages or Faces

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

  1. Upgrade Apache Shiro (shiro-web and shiro-jakarta-ee) to 3.0.2 or later

The Brief

  • Apache Shiro principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting (XSS).
  • Source gives a CVSS 4.0 base score of 2.1 (low), with low privileges required and user interaction needed.
  • Affected: org.apache.shiro:shiro-web before 3.0.2, and org.apache.shiro:shiro-jakarta-ee (the affected range is cut off in the source).

Why it matters

Applications that render Shiro principal tags in JSP or Jakarta Faces pages can let attacker-controlled user data run as script in other users' browsers, so affected apps should be patched.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsJudgment: Apache Shiro is a Java library for developers building and running applications.
NoCore infrastructureJudgment: a single Java security framework, not core infrastructure like OpenSSH or the Linux kernel.
YesPopular toolJudgment: Shiro is a widely used Java framework with heavy Maven Central download counts.
NoExploited in the wildOpen Source Security: advisory reports the XSS flaw only; no observed attacks mentioned.
NoPublic exploitOpen Source Security: advisory describes the flaw; no published exploit or PoC mentioned.
NoRemote, no loginOpen Source Security: CVSS vector shows PR:L and UI:P, requiring low privileges and user interaction.
NoFull takeoverOpen Source Security: flaw is cross-site scripting; CVSS impact VC:N/VI:N/VA:N, no code execution or takeover.
NoSecrets exposedOpen Source Security: no reported data theft or exposure of secrets or user data.
NoSupply chainOpen Source Security: normal output-escaping bug in legitimate code, not malicious code shipped.
NoNo fix yetOpen Source Security: affected versions listed as before 3.0.2, implying a fixed release exists.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

Timeline

  1. Vulnerability disclosed on the oss-security mailing list by Lenny Primak

  2. Open Source Security

    CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting

Source

CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting ↗ Open Source Security · 3h ago

First seen · 1 source · Full story page · How tiers are decided

Tier C: Apache Shiro XSS via unescaped principal tags in Jakarta Pages and Faces (CVE-2026-129320) – The Morning Dev