# CVE-2026-21825: HCL Digital Experience Compose reflected XSS in search center

Source: https://junglewise.ai/threats/cve-2026-21825-hcl-digital-experience-compose-reflected-xss-in-search-center  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-21825 · Severity: medium · CVSS 6.1 · Published 2026-06-05

HCL Digital Experience Compose, a platform used for building and managing digital content and web experiences, contains a security flaw in its search center component. An attacker could trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's web browser. This could lead to the theft of sensitive session information or the unauthorized performance of actions on behalf of the user.

Technologies: [HCL Digital Experience Compose](https://junglewise.ai/threats/technologies/digital-experience-compose). Vendors: [HCL](https://junglewise.ai/threats/vendors/hcl).

## Quick answers

**Is CVE-2026-21825 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21825 being exploited in the wild.

**How severe is CVE-2026-21825?** Medium severity, with a CVSS score of 6.1, published 5 June 2026.

**Which products and versions are affected?** HCL Digital Experience Compose.

**Is there a fix for CVE-2026-21825?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-21825 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-21825?** Check whether you run HCL Digital Experience Compose. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the search center component of HCL Digital Experience Compose. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by persuading a user to visit a specially crafted URL. Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking or unauthorized data access. The vulnerability is tracked as CVE-2026-21825 and has been assigned a CVSS v3.1 base score of 6.1.

## Affected products

- HCL Digital Experience Compose

## Timeline

- 2026-06-05: disclosed
- 2026-06-05: advisory

## References

- [https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849)

## Related threats

- [HCL Digital Experience OS command injection in Digital Asset Management API](https://junglewise.ai/threats/cve-2026-21837-hcl-digital-experience-os-command-injection-in-digital-asset)
- [HCL Digital Experience Host header injection](https://junglewise.ai/threats/cve-2026-21826-hcl-digital-experience-host-header-injection)