CVE-2026-85229 in SkyWalking
Summary
by MITRE • 09/04/2026
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.
This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.
Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Apache SkyWalking Booster UI represents a classic cross-site scripting flaw resulting from improper neutralization of user-supplied input during dynamic web page generation. This security defect specifically impacts versions ranging from 10.2.0 through 10.4.0, where the application fails to adequately sanitize or encode data before rendering it within the browser context. By allowing untrusted input to be interpreted as executable code rather than static content, the system creates an avenue for attackers to inject malicious scripts into web pages viewed by other users. This type of vulnerability is formally categorized under CWE-79 in the Common Weakness Enumeration standard, which defines Improper Neutralization of Input During Web Page Generation as a critical category of injection flaws that compromise client-side integrity and confidentiality.
From an operational perspective, this cross-site scripting weakness allows malicious actors to execute arbitrary JavaScript code within the security context of the trusted Apache SkyWalking domain. The consequences can be severe, ranging from session hijacking through theft of authentication cookies or tokens, to keylogging activities that capture sensitive credentials entered by legitimate users. Furthermore, attackers may leverage this vulnerability to perform actions on behalf of authenticated victims without their consent, such as modifying configuration settings, exfiltrating telemetry data, or defacing the user interface. The impact is compounded if the application handles sensitive observability metrics or infrastructure details, as the injected script could harvest and transmit this proprietary information to an external server controlled by the attacker.
The attack vector for this vulnerability typically involves tricking a victim into clicking a maliciously crafted link or visiting a compromised page that contains the payload designed to exploit the input handling deficiency in the UI components of SkyWalking Booster. Once executed, the script operates with full privileges granted to the web application, bypassing same-origin policy restrictions and accessing local storage or other browser APIs. This aligns with techniques documented in the MITRE ATT&CK framework under T1059, specifically Command and Scripting Interpretation via JavaScript, which highlights how attackers utilize built-in browser capabilities to achieve their objectives without deploying external malware binaries.
To mitigate this risk, organizations must immediately upgrade Apache SkyWalking UI components from versions 10.2.0 through 10.4.0 to Horizon UI version 1.0.0 or later, as indicated in the vendor advisory. This update addresses the underlying input validation logic by implementing robust encoding and sanitization mechanisms that ensure all dynamic content is treated strictly as data rather than executable code. In addition to upgrading software dependencies, security teams should enforce strict Content Security Policy headers on any remaining instances of the vulnerable UI to restrict script execution sources and prevent inline scripts from running even if an injection attempt occurs. Regular vulnerability scanning and penetration testing focused on input validation flaws are also recommended to detect similar weaknesses in other web-facing components before they can be exploited by adversaries seeking to compromise observability infrastructure.