CVE-2026-123765 Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.
Unknown
EPSS 0.20%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.sling/org.apache.sling.xss(Maven) | < 2.4.14 | 2.4.14 |
References
- lists.apache.org vendor-advisory
- www.openwall.com