CVE-2026-85229: Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)

[Sheng Wu <wusheng () apache org>]

Affected versions:

- Apache SkyWalking 10.2.0 through 10.4.0

Description:

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking 
Booster UI.



This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.



Users are recommended to upgrade to version Horizon UI 1.0.0, which fixes the issue.

Credit:

n0mi1k (reporter)

References:

https://skywalking.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85229