Reflected XSS in Apache Sling XSS library getValidHref() (<=2.4.10)
Apache Sling XSS versions 2.4.10 and prior fail to correctly neutralize attacker-controlled input passed through the XSSAPI.getValidHref() method, so href values sanitized by the library can still carry injected script. Exploitation requires a victim to follow an attacker-crafted link whose value is reflected into any application feature that relies on getValidHref() for sanitization (the CVSS vector confirms user interaction is required). A successful attack lets the attacker execute script in the victim's browser within the vulnerable application's context, enabling session/credential theft, content manipulation, or phishing despite the app doing 'correct' sanitization. Any Java application embedding the Sling XSS support library is potentially affected — most notably platforms built on Apache Sling such as Adobe Experience Manager, where the flaw could surface in many features at once. There is no known public proof of concept and no evidence of exploitation in the wild; the issue is not on the CISA KEV list.
What to do: Upgrade the Sling XSS library to 2.4.12 or later; AEM/Sling platform users should apply the vendor's updated bundle rather than manually replacing the jar. Audit your code for XSSAPI.getValidHref() calls that handle request-derived href values, since every such call site is a potential reflected XSS sink. As an interim measure, filter or encode javascript:/data:-style URI payloads in href parameters via a WAF and monitor logs for suspicious link parameters.
| Apache Software Foundation Apache Sling XSS (XSS support library, org.apache.sling.xss) | 2.4.10 and all prior versions (fixed in 2.4.12) |
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.
A low-severity reflected cross-site scripting (XSS) vulnerability, CVE-2026-73192, has been disclosed in the Apache Sling XSS library. The flaw exists in the XSSAPI.getValidHref() method, potentially allowing script injection. Users are advised to upgrade to version 2.4.12 to mitigate the risk.