CVE-2026-73192 PUBLISHED

Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Assigner: apache
Reserved: 11.08.2026 Published: 23.09.2026 Updated: 23.09.2026

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.

Upgrade to Apache Sling XSS >= 2.4.12

Product Status

Vendor Apache Software Foundation
Product Apache Sling XSS
Versions Default: unaffected
  • affected from 0 to 2.4.12 (excl.)

Credits

  • Apache Sling would like to thank github user Vectrain51 and n0mi1k for reporting this issue finder

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE