Executive brief
Apache SkyWalking UI is a web-based interface for application performance monitoring. An attacker can inject malicious scripts into web pages viewed by users, potentially stealing session credentials, manipulating displayed data, or redirecting users to malicious sites. This vulnerability affects versions 10.2.0 through 10.4.0 and requires user interaction to exploit.
Technical details
This is a cross-site scripting (XSS) vulnerability caused by improper neutralization of user input during web page generation in Apache SkyWalking UI. The vulnerability allows an attacker to inject malicious JavaScript code that executes in the context of a user's browser session. The attack requires the victim to visit a crafted link or page, and does not require authentication. Successful exploitation enables account takeover, session hijacking, or data theft. The issue has been fixed in Horizon UI 1.0.0.
Affected products
- Apache SkyWalking UI 10.2.0 through 10.4.0
Timeline
- 2026-09-04: disclosed