CVE-2026-123765 PUBLISHED

Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.

Assigner: apache
Reserved: 06.11.2026 Published: 12.11.2026 Updated: 12.11.2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.

This issue affects Apache Sling XSS: before 2.4.14.

Users are recommended to upgrade to version 2.4.14, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Sling XSS
Versions Default: unaffected
  • affected from 0 to 2.4.14 (excl.)

Credits

  • Github user @dpfkdlemtp reporter

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE