Cross-Site Scripting Vulnerability in CodeChecker by Ericsson

CVE-2026-84164

What is CVE-2026-84164?

An XSS vulnerability exists in the HTML reports generated by the plist-to-html and various CodeChecker commands. Due to improper escaping of the less-than character in the JSON output through json.dumps, malicious input can lead to the premature termination of script elements, resulting in the injection of harmful HTML scripts. The impact can be substantial when these reports are published without adequate Content Security Policies (CSP), potentially compromising web applications consuming the outputs.

References