Stored cross-site scripting in CodeChecker HTML report export
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Ericsson CodeChecker before 6.29.3 places the report message, checker name and source file path into a script block in its HTML reports using json.dumps. json.dumps does not escape the less-than character, so a closing script tag in one of these fields lets injected markup run when a user opens the report. This is cross-site scripting (CWE-79). An attacker needs control of the analysed source tree or a third-party result file, and a user must open the report.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade Ericsson CodeChecker to version 6.29.3, which fixes this flaw. Later versions also contain the fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA CodeChecker (Ericsson) Fixed in 6.29.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ericsson CodeChecker 6.29.3
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-85815 Session tokens stay valid after logout in CodeCheckerPriority LOW 23
- TI-2026-85880 Unbounded zlib decompression in CodeChecker enables denial of servicePriority LOW 22
Timeline
- 2026-11-06 Threatist record created from CVE-2026-84164
More Ericsson vulnerabilities
- TI-2024-09344 Authentication bypass in Ericsson CodeChecker CVSS 3.1CRITICAL 10.0
- TI-2024-36027 Cross-Site Request Forgery in CodeChecker API CVSS 3.1HIGH 8.2
- TI-2025-27277 Buffer overflow in CodeChecker log command CVSS 3.1HIGH 7.8
- TI-2023-27200 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` CVSS 3.1MEDIUM 6.5
- TI-2026-41851 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun CVSS 4.0MEDIUM 5.5
- TI-2021-19324 In Ericsson Network Location before 2021-07-31, it is possible for an authenticated… CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences