{"id":"CVE-2026-85229","title":"** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.\n\n\n\nThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\n…","summary":"** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.\n\n\n\nThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\n…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"Apache Software Foundation","product":"Apache SkyWalking","affected":["apache_skywalking >= 10.2.0 <= 10.4.0"],"published":"2026-09-04","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:20:07.457","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85229","references":[{"url":"https://lists.apache.org/thread/oswo0kxr7g2jgdoz3wd923nslo36jsv8","label":"security@apache.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T18:56:52.746783Z"},"epss":0.00156,"epssPercentile":0.05219,"ingestedAt":"2026-09-08T15:33:26.959Z","slug":"CVE-2026-85229","body":"## Overview\n\n** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.\n\n\n\nThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\n\n\n\nUsers are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8300,"id":"CVE-2026-85229","ts":1788919996438,"field":"cvss","old":null,"new":"6.1"},{"seq":8299,"id":"CVE-2026-85229","ts":1788919996438,"field":"severity","old":"none","new":"medium"},{"seq":8109,"id":"CVE-2026-85229","ts":1788919283181,"field":"cvss","old":"6.1","new":null},{"seq":8108,"id":"CVE-2026-85229","ts":1788919283181,"field":"severity","old":"medium","new":"none"},{"seq":7918,"id":"CVE-2026-85229","ts":1788916357692,"field":"cvss","old":null,"new":"6.1"},{"seq":7917,"id":"CVE-2026-85229","ts":1788916357692,"field":"severity","old":"none","new":"medium"},{"seq":7727,"id":"CVE-2026-85229","ts":1788915300341,"field":"cvss","old":"6.1","new":null},{"seq":7726,"id":"CVE-2026-85229","ts":1788915300341,"field":"severity","old":"medium","new":"none"},{"seq":7536,"id":"CVE-2026-85229","ts":1788912718199,"field":"cvss","old":null,"new":"6.1"},{"seq":7535,"id":"CVE-2026-85229","ts":1788912718199,"field":"severity","old":"none","new":"medium"},{"seq":7345,"id":"CVE-2026-85229","ts":1788911333248,"field":"cvss","old":"6.1","new":null},{"seq":7344,"id":"CVE-2026-85229","ts":1788911333248,"field":"severity","old":"medium","new":"none"},{"seq":7149,"id":"CVE-2026-85229","ts":1788909079775,"field":"cvss","old":null,"new":"6.1"},{"seq":7148,"id":"CVE-2026-85229","ts":1788909079775,"field":"severity","old":"none","new":"medium"},{"seq":6961,"id":"CVE-2026-85229","ts":1788907392094,"field":"cvss","old":"6.1","new":null},{"seq":6960,"id":"CVE-2026-85229","ts":1788907392094,"field":"severity","old":"medium","new":"none"},{"seq":6763,"id":"CVE-2026-85229","ts":1788905445627,"field":"cvss","old":null,"new":"6.1"},{"seq":6762,"id":"CVE-2026-85229","ts":1788905445627,"field":"severity","old":"none","new":"medium"},{"seq":6581,"id":"CVE-2026-85229","ts":1788903460319,"field":"cvss","old":"6.1","new":null},{"seq":6580,"id":"CVE-2026-85229","ts":1788903460319,"field":"severity","old":"medium","new":"none"},{"seq":6367,"id":"CVE-2026-85229","ts":1788901811542,"field":"cvss","old":null,"new":"6.1"},{"seq":6366,"id":"CVE-2026-85229","ts":1788901811542,"field":"severity","old":"none","new":"medium"},{"seq":6197,"id":"CVE-2026-85229","ts":1788899562629,"field":"cvss","old":"6.1","new":null},{"seq":6196,"id":"CVE-2026-85229","ts":1788899562629,"field":"severity","old":"medium","new":"none"},{"seq":5960,"id":"CVE-2026-85229","ts":1788898181021,"field":"cvss","old":null,"new":"6.1"},{"seq":5959,"id":"CVE-2026-85229","ts":1788898181021,"field":"severity","old":"none","new":"medium"},{"seq":5849,"id":"CVE-2026-85229","ts":1788895711437,"field":"cvss","old":"6.1","new":null},{"seq":5848,"id":"CVE-2026-85229","ts":1788895711437,"field":"severity","old":"medium","new":"none"},{"seq":5725,"id":"CVE-2026-85229","ts":1788894572647,"field":"cvss","old":null,"new":"6.1"},{"seq":5724,"id":"CVE-2026-85229","ts":1788894572647,"field":"severity","old":"none","new":"medium"}]}