CVE-2026-21825: HCL Digital Experience Compose XSS Flaw

CVE-2026-21825 Overview

CVE-2026-21825 is a reflected cross-site scripting (XSS) vulnerability affecting HCL Digital Experience Compose, specifically in the search center component. An attacker can craft a malicious URL that, when opened by an authenticated victim, causes arbitrary JavaScript to execute in the victim's browser session. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and impacts version 9.5 across numerous cumulative fix (CF) levels of both digital_experience_compose and digital_experience products.

Critical Impact
An attacker can execute arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, defacement, or redirection to attacker-controlled sites — all without compromising the server directly.

Affected Products

HCL Digital Experience Compose 9.5 (base release through cf234)
HCL Digital Experience 9.5 (base release, cf17 through cf234)
HCL Digital Experience Search Center component

Discovery Timeline

2026-06-05 - CVE-2026-21825 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-21825

Vulnerability Analysis

The vulnerability resides in the search center feature of HCL Digital Experience (DX) Compose. The application reflects user-supplied input back into rendered HTML without applying adequate output encoding or input sanitization. An attacker delivers a crafted URL containing a JavaScript payload to a victim. When the victim loads the link, the search center reflects the payload into the response page, where the browser parses and executes it in the context of the application's origin.

Because this is a reflected XSS (CVSS scope changed, user interaction required), exploitation depends on tricking a logged-in user into clicking the malicious link. Successful execution allows the attacker to read session tokens accessible to scripts, perform actions on behalf of the user, and exfiltrate data rendered within the DX portal. The EPSS probability of exploitation remains low at the time of publication.

Root Cause

The root cause is improper neutralization of user input in the search center's response rendering path. Input parameters supplied to search queries are echoed into HTML output without being passed through a contextual encoder. This permits HTML and script-context breakouts that the browser then interprets as executable code.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or distributes a malicious URL pointing to the DX search center endpoint with a script payload in a vulnerable parameter. Distribution typically occurs via phishing email, social media, instant messaging, or a compromised third-party site. When a portal user clicks the link while authenticated, the payload executes in the user's browser under the trust boundary of the HCL DX application.

For technical specifics, refer to the HCL Software Knowledge Base Article.

Detection Methods for CVE-2026-21825

Indicators of Compromise

HTTP GET or POST requests to the HCL DX search center containing URL-encoded <script>, javascript:, onerror=, or onload= tokens in query parameters.
Unusually long or obfuscated query strings on search endpoints, including base64-encoded payloads or fragmented JavaScript.
Outbound browser requests from portal users to unfamiliar external domains shortly after clicking inbound links to the search center.
Web server access logs showing referer headers from suspicious email gateways or shortened URL services followed by search center hits.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters destined for the search center for HTML special characters and script-context patterns.
Correlate authentication events with anomalous search center requests to identify session reuse from unexpected IP addresses post-click.
Hunt for clipboard, cookie, or document.location access patterns originating from the DX origin in browser telemetry where available.

Monitoring Recommendations

Enable verbose HTTP access logging on the DX server and forward logs to a centralized SIEM for parameter-level inspection.
Monitor Content Security Policy (CSP) violation reports if CSP is configured in report-only or enforcing mode.
Track user-agent and referer anomalies on search center endpoints to flag campaign-driven link delivery.

How to Mitigate CVE-2026-21825

Immediate Actions Required

Apply the HCL-provided fix referenced in HCL Knowledge Base KB0130849 as soon as it is available for your CF level.
Restrict access to the search center to authenticated, trusted users via network controls until patching is complete.
Educate portal users about the risk of clicking unsolicited links pointing to internal DX URLs.

Patch Information

HCL has published remediation guidance in Knowledge Base article KB0130849. Administrators should consult the advisory to identify the applicable interim fix or cumulative fix (CF) level for their installed version of HCL Digital Experience 9.5 and HCL Digital Experience Compose 9.5, then schedule deployment through their standard change management process.

Workarounds

Deploy a WAF rule set that blocks or sanitizes requests containing HTML or script metacharacters in search center parameters.
Enforce a strict Content Security Policy disallowing inline scripts and limiting script-src to trusted origins to reduce payload impact.
Enable HttpOnly and Secure flags on session cookies to limit the data accessible to injected scripts.
Configure short session timeouts and require step-up authentication for sensitive portal actions.

bash

# Example NGINX-fronted mitigation: block obvious XSS payloads on search endpoints
location ~* /wps/.*search.* {
    if ($args ~* "(<|%3C)[^>]*script|javascript:|onerror=|onload=") {
        return 403;
    }
    proxy_pass http://hcl_dx_backend;
}

# Example Content-Security-Policy response header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";