{"id":"CVE-2026-93684","revision":"032ae24a4b664b1e9c3c49e89da164f8","records":[{"revision":"032ae24a4b664b1e9c3c49e89da164f8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93684","aliases":[],"title":"Apache Impala: Stored XSS in Impala query plans","description":"An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is\u00A0stored\u00A0XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.","state":0,"publishedAt":"2026-10-07T08:48:45.195+00:00","modifiedAt":"2026-10-07T18:45:38.092+00:00","affected":[{"ecosystem":"Vendor product","name":"Apache Impala","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache Impala\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.7.0\",\n                            \"lessThanOrEqual\": \"4.5.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread.html/qxjj5n3vsttxbvq2n75xcy2qcrhtxowx"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93684","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93684","identifiers":["CVE-2026-93684"]},"retained":false,"historicalAffected":[]}],"coverage":[]}