CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Apache Sling XSS, the Java library (org.apache.sling.xss) that Sling-based applications use to sanitize user-supplied HTML and rich text before rendering, fails to properly neutralize crafted input, allowing a cross-site scripting (XSS) protection bypass. An attacker submits specially structured markup that slips past the sanitizer; when a victim views a page containing that content, the attacker's script executes in the victim's browser session, enabling session/cookie theft, defacement, or in-session actions against Sling-based applications such as Adobe Experience Manager, which embeds this library. The flaw (CVSS 3.1: 6.1, medium) is network-reachable without privileges but requires user interaction and yields only limited confidentiality and integrity impact. All deployments using Apache Sling XSS before version 2.4.12 are affected, and the fix is an upgrade to 2.4.12. No public proof-of-concept is known, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and there is no indication of in-the-wild exploitation.