DEBIAN-CVE-2026-120421: Debian/mojarra vulnerability

Published Nov 4, 2026

Updated

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENTWINDOWMODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

Affected Software

3 affected components

debian/mojarra*

Event History

Nov 4, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Eclipse Mojarra in the affected version ranges are exposed when URL client window mode is enabled with jakarta.faces.CLIENT_WINDOW_MODE=url. The vulnerable behavior involves pages that render h:button-generated URLs.

What does an attacker need to exploit it?

An attacker needs to supply a malicious client window identifier through the jfwid or jakarta.faces.ClientWindow request parameter. The value is reflected into a generated URL without URL-encoding and can break out of the JavaScript string rendered by h:button.

Does enabling a CSP nonce prevent exploitation?

No. When com.sun.faces.enableCspNonce=true is enabled, the injected script runs on page load within the nonce-bearing script element, bypassing the Content Security Policy.

DEBIAN-CVE-2026-120421: Debian/mojarra vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does enabling a CSP nonce prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does enabling a CSP nonce prevent exploitation?