Cross-Site Scripting Vulnerability in Apache Sling by Apache

CVE-2026-123765

What is CVE-2026-123765?

A cross-site scripting (XSS) vulnerability exists in Apache Sling due to improper neutralization of user input during web page generation. Specifically, the xssAPI.getStyleToken() function improperly handles markup in unquoted URLs, allowing an attacker to execute arbitrary scripts in the context of another user. This can result in unauthorized actions or data exposure. Users are advised to upgrade to Apache Sling XSS version 2.4.14 or later to mitigate this security risk.

References