CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Apache Sling XSS before 2.4.12 has a moderate XSS sanitizer bypass, CVE-2026-91928.
Apache Sling XSS before 2.4.12 fails to neutralize input during web page generation, enabling cross-site scripting. The moderate-severity issue also involves sanitizer bypass, uncontrolled resource consumption, and failure of protection mechanisms. Users are advised to upgrade to 2.4.12. It is tracked as SLING-13333 and CVE-2026-91928, with no exploitation reported.
- Affects Apache Sling XSS before 2.4.12
- Rated moderate; fixed in version 2.4.12
- Tracked as CVE-2026-91928 and SLING-13333
- Covers sanitizer bypass and uncontrolled resource use
- CVEs
- CVE-2026-91928
- Vendors
- Apache Software Foundation
- Products
- Apache Sling XSS
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91928 | XSS Sanitizer Bypass in Apache Sling XSS Library (< 2.4.12) | 6.1 | — |
From the original article
Posted by Joerg Hoh on Sep 23 Severity: moderate Affected versions: - Apache Sling XSS before 2. 4. 12 Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.