CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

oss-securitySep 23, 2026 · 15:53 UTC (Sep 23, 2026)3 · 1 read

Part of a story covered by 7 sourcesSeven Apache Sling vulnerabilities disclosed via oss-security: five XSS-library CVEs fixed in 2.4.12 plus two low-severity Security Bundle flawsMerged summary & timeline

AI summary · glm-5.3Summaries by Vani AI

Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.

A low-severity reflected cross-site scripting (XSS) vulnerability, CVE-2026-73192, has been disclosed in the Apache Sling XSS library. The flaw exists in the XSSAPI.getValidHref() method, potentially allowing script injection. Users are advised to upgrade to version 2.4.12 to mitigate the risk.

Key facts

Low-severity reflected XSS in Apache Sling XSS library.
Vulnerability in XSSAPI.getValidHref() allows script injection.
Patched in version 2.4.12.

Analyze CVE-2026-73192 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-73192

Tags: apache-sling cve open-source web-security xss

Vendors: Apache
Products: Apache Sling XSS
Organizations: Apache Software Foundation

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-73192	Reflected XSS in Apache Sling XSS library getValidHref() (<=2.4.10)	6.1	—		Sep 23, 2026

From the original article

Posted by Joerg Hoh on Sep 23 Severity: low Affected versions: - Apache Sling XSS before 2. 4. 12 Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.