# CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/699) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-129320-apache-shiro-principal-tags-in-jakarta-pages-and-jakarta-faces-d-3537599fc477d0b9
Kind: security · Impact: low

## In brief

- Apache Shiro principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting (XSS).
- Source gives a CVSS 4.0 base score of 2.1 (low), with low privileges required and user interaction needed.
- Affected: org.apache.shiro:shiro-web before 3.0.2, and org.apache.shiro:shiro-jakarta-ee (the affected range is cut off in the source).

## Why it matters

Applications that render Shiro principal tags in JSP or Jakarta Faces pages can let attacker-controlled user data run as script in other users' browsers, so affected apps should be patched.

## What to do

- Upgrade Apache Shiro (shiro-web and shiro-jakarta-ee) to 3.0.2 or later

## Versions

- Apache Shiro before 3.0.2
- Apache Shiro 3.0.2

## CVEs

- CVE-2026-129320

## Timeline

- 2026-11-13: Vulnerability disclosed on the oss-security mailing list by Lenny Primak

## Coverage

- [CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting](https://seclists.org/oss-sec/2026/q4/699) — Open Source Security, 2026-11-14

Tags: security, xss, apache-shiro, java, jakarta-ee, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev