CVE-2026-91852

Apache Sling XSS, the anti-XSS filtering library used by Sling-based Java applications (including Adobe Experience Manager), contains an improper input neutralization flaw (CWE-79) in XSSImpl prior to version 2.4.12. The flaw includes multiple 'raw-string break-outs', meaning attacker-controlled content can escape the library's sanitization, plus a regular-expression denial-of-service (ReDoS) issue in the same component. When an application uses the library to filter untrusted input that is later rendered in a generated web page, an attacker who can get crafted content stored or reflected and viewed by a victim can execute script in the victim's browser, potentially hijacking their session or performing actions on their behalf. The ReDoS component can additionally be triggered to hang processing threads with pathological input. The fix is upgrading to Apache Sling XSS 2.4.12; there is no known public proof of concept and no evidence of exploitation in the wild.

What to do: Upgrade the Apache Sling XSS bundle (org.apache.sling.xss) to version 2.4.12, deploying via the OSGi console or a dependency bump, and if you run Adobe Experience Manager apply the corresponding bundle update when Adobe publishes it. Audit applications that rely on XSSImpl for sanitization and review rendered user-supplied content for any injected scripts that may have bypassed the old filter. Until patched, limit input sizes and use WAF rules to mitigate both the stored/reflected XSS risk and the ReDoS condition in XSSImpl.