# CVE-2026-84164: CodeChecker stored XSS in HTML report export

Source: https://junglewise.ai/threats/cve-2026-84164-the-html-report-that-plist-to-html-codechecker-parse-export-html  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-84164 · Severity: info · Published 2026-11-06

CodeChecker generates static HTML vulnerability reports that fail to properly escape special characters in diagnostic messages, file paths, and checker names. An attacker who controls the analyzed source code or result files can inject malicious JavaScript that executes when a user views the report, potentially stealing session data or performing actions on behalf of the viewer depending on where the report is published.

Technologies: [Ericsson Codechecker](https://junglewise.ai/threats/technologies/ericsson-codechecker). Vendors: [Ericsson](https://junglewise.ai/threats/vendors/ericsson).

## Quick answers

**Is CVE-2026-84164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84164 being exploited in the wild.

**How severe is CVE-2026-84164?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Ericsson Codechecker before 6.29.3.

**Is there a fix for CVE-2026-84164?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84164 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84164?** Check whether you run Ericsson Codechecker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Stored cross-site scripting (XSS) vulnerability in the HTML report export functionality (plist-to-html, CodeChecker parse --export html, and CodeChecker cmd diff --output html). The vulnerability occurs because json.dumps does not escape the less-than character when embedding report metadata (message, checker name, file path) into script blocks, allowing a closing script tag to prematurely end the element and inject arbitrary HTML/JavaScript. The vulnerability affects multiple code paths: static exporters, the cmd diff flow via getRunResults, and bugviewer.js which assigns innerHTML without sanitization.

## Affected products

- Ericsson CodeChecker before 6.29.3

## Timeline

- 2026-11-05: disclosed
- 2026-11-06: advisory

## References

- [https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq](https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq)

## Related threats

- [Ericsson CodeChecker unbounded zlib decompression in storeAnalysisStatistics](https://junglewise.ai/threats/cve-2026-84161-when-an-operator-enables-store-analysis-statistics-dir-a-network)
- [CodeChecker session token remains valid after logout](https://junglewise.ai/threats/cve-2026-84155-codechecker-s-web-server-fails-to-fully-invalidate-a-session)
- [Codechecker has an authentication bypass for certain API calls](https://junglewise.ai/threats/cve-2026-25660-codechecker-has-an-authentication-bypass-for-certain-api-calls)
- [Ericsson CodeChecker stack overflow in ldlogger library](https://junglewise.ai/threats/cve-2025-40843-ericsson-codechecker-stack-overflow-in-ldlogger-library)