Read the docs
TI-2026-17544 Aliases CVE-2026-21825GHSA-26cp-fff5-jqv5

Cross-site scripting in HCL Software DX Compose

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareDX Compose9.5—No fix listedCNA
  • DX Compose VendorHCL Software Affected 9.5 Fixed in — No fix listed CNA

CPE configurations NVD · 67

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:*9.5VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:*9.5 cf224VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:*9.5 cf225VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:*9.5 cf226VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:*9.5 cf227VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:*9.5 cf228VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:*9.5 cf229VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:*9.5 cf230VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:*9.5 cf231VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:*9.5 cf232VulnerableHCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:* Versions 9.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:* Versions 9.5 cf224 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:* Versions 9.5 cf225 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:* Versions 9.5 cf226 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:* Versions 9.5 cf227 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:* Versions 9.5 cf228 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:* Versions 9.5 cf229 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:* Versions 9.5 cf230 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:* Versions 9.5 cf231 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:* Versions 9.5 cf232 Vulnerable ·HCL Software
Show 57 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:*9.5 cf233VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:*9.5 cf234VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:*9.5VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:*9.5 cf17VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:*9.5 cf171VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:*9.5 cf172VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:*9.5 cf173VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:*9.5 cf18VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:*9.5 cf181VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:*9.5 cf182VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:*9.5 cf183VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:*9.5 cf184VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:*9.5 cf19VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:*9.5 cf191VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:*9.5 cf192VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:*9.5 cf193VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:*9.5 cf194VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:*9.5 cf195VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:*9.5 cf196VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:*9.5 cf197VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:*9.5 cf198VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:*9.5 cf199VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:*9.5 cf200VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:*9.5 cf201VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:*9.5 cf202VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:*9.5 cf203VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:*9.5 cf204VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:*9.5 cf205VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:*9.5 cf206VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:*9.5 cf207VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:*9.5 cf208VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:*9.5 cf209VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:*9.5 cf210VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:*9.5 cf211VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:*9.5 cf212VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:*9.5 cf213VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:*9.5 cf214VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:*9.5 cf215VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:*9.5 cf216VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:*9.5 cf217VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:*9.5 cf218VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:*9.5 cf219VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:*9.5 cf220VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:*9.5 cf221VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:*9.5 cf222VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:*9.5 cf223VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:*9.5 cf224VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:*9.5 cf225VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:*9.5 cf226VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:*9.5 cf227VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:*9.5 cf228VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:*9.5 cf229VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:*9.5 cf230VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:*9.5 cf231VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:*9.5 cf232VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:*9.5 cf233VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:*9.5 cf234VulnerableHCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:* Versions 9.5 cf233 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:* Versions 9.5 cf234 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:* Versions 9.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:* Versions 9.5 cf17 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:* Versions 9.5 cf171 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:* Versions 9.5 cf172 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:* Versions 9.5 cf173 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:* Versions 9.5 cf18 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:* Versions 9.5 cf181 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:* Versions 9.5 cf182 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:* Versions 9.5 cf183 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:* Versions 9.5 cf184 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:* Versions 9.5 cf19 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:* Versions 9.5 cf191 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:* Versions 9.5 cf192 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:* Versions 9.5 cf193 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:* Versions 9.5 cf194 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:* Versions 9.5 cf195 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:* Versions 9.5 cf196 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:* Versions 9.5 cf197 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:* Versions 9.5 cf198 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:* Versions 9.5 cf199 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:* Versions 9.5 cf200 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:* Versions 9.5 cf201 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:* Versions 9.5 cf202 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:* Versions 9.5 cf203 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:* Versions 9.5 cf204 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:* Versions 9.5 cf205 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:* Versions 9.5 cf206 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:* Versions 9.5 cf207 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:* Versions 9.5 cf208 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:* Versions 9.5 cf209 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:* Versions 9.5 cf210 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:* Versions 9.5 cf211 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:* Versions 9.5 cf212 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:* Versions 9.5 cf213 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:* Versions 9.5 cf214 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:* Versions 9.5 cf215 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:* Versions 9.5 cf216 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:* Versions 9.5 cf217 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:* Versions 9.5 cf218 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:* Versions 9.5 cf219 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:* Versions 9.5 cf220 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:* Versions 9.5 cf221 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:* Versions 9.5 cf222 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:* Versions 9.5 cf223 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:* Versions 9.5 cf224 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:* Versions 9.5 cf225 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:* Versions 9.5 cf226 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:* Versions 9.5 cf227 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:* Versions 9.5 cf228 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:* Versions 9.5 cf229 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:* Versions 9.5 cf230 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:* Versions 9.5 cf231 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:* Versions 9.5 cf232 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:* Versions 9.5 cf233 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:* Versions 9.5 cf234 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21825
  2. 2026-10-03 Alias added: GHSA-26cp-fff5-jqv5

References

Advisory 1

  • TI-2023-19137 Cross-site scripting in HCL Software Digital Experience CVSS 3.1CRITICAL 9.3
  • TI-2026-17550 OS command injection in HCL Software Digital Experience CVSS 4.0HIGH 8.7
  • TI-2020-11152 HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive… CVSS 3.1HIGH 7.5
  • TI-2020-11138 Cross-site scripting in HCL Digital Experience CVSS 3.1MEDIUM 6.1
  • TI-2020-03560 In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS). CVSS 3.1MEDIUM 6.1
  • TI-2026-17545 Open redirect in HCL Software Digital Experience & DX Compose CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences