GHSA-j548-68g5-9j7x

Source

https://github.com/advisories/GHSA-j548-68g5-9j7x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j548-68g5-9j7x

Aliases

Downstream

MINI (4)

Published

2026-06-30T12:31:52Z

Modified

2026-11-05T17:56:10Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting

Details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.

The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-05T17:35:05Z",
    "nvd_published_at": "2026-06-30T11:16:30Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven

org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.19.8

Affected versions

4.*

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

5.19.2

5.19.3

5.19.4

5.19.5

5.19.6

5.19.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json"

org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.2.7

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json"

org.apache.activemq:activemq-web-console

Package

Name: org.apache.activemq:activemq-web-console; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-web-console

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.19.8

Affected versions

4.*

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

5.19.2

5.19.3

5.19.4

5.19.5

5.19.6

5.19.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json"

org.apache.activemq:activemq-web-console

Package

Name: org.apache.activemq:activemq-web-console; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/activemq-web-console

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.2.7

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json"