CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Apache Sling XSS versions 2.4.10 and prior fail to correctly neutralize attacker-controlled input passed through the XSSAPI.getValidHref() method, so href values sanitized by the library can still carry injected script. Exploitation requires a victim to follow an attacker-crafted link whose value is reflected into any application feature that relies on getValidHref() for sanitization (the CVSS vector confirms user interaction is required). A successful attack lets the attacker execute script in the victim's browser within the vulnerable application's context, enabling session/credential theft, content manipulation, or phishing despite the app doing 'correct' sanitization. Any Java application embedding the Sling XSS support library is potentially affected — most notably platforms built on Apache Sling such as Adobe Experience Manager, where the flaw could surface in many features at once. There is no known public proof of concept and no evidence of exploitation in the wild; the issue is not on the CISA KEV list.