Apache Juneau versions through 9.2.0 have a cross-site scripting (XSS) vulnerability due to improper HTML encoding of variable substitutions in page chrome elements. This affects applications that include request-derived variables in the chrome, such as headers or form data, reflecting unencoded input and enabling XSS attacks. The default chrome does not use request variables, so only customized applications are impacted. The issue is fixed in version 9.2.1.