Apache Sling XSS before 2.4.14 allows XSS via getStyleToken (CVE-2026-123765)
Original title: CVE-2026-123765: Apache Sling XSS: SLING-13406
xssAPI.getStyleToken() accepts markup in unquoted URLs; Apache rates it low and fixes it in 2.4.14.
Joerg Hoh reported a cross-site scripting flaw in Apache Sling XSS, tracked as SLING-13406 and CVE-2026-123765. xssAPI.getStyleToken() does not properly neutralize markup in unquoted URLs during web page generation. Versions before 2.4.14 are affected. Apache rates the issue low and recommends upgrading to 2.4.14.
Unconfirmed: The post does not say whether the flaw is exploited.
- Severity is listed as low.
- The flaw is tracked as SLING-13406.
- Only Apache Sling XSS before 2.4.14 is named as affected.
- The recommended fix is version 2.4.14.
Impact: cross-site scripting via markup in unquoted URLs
| Product | Affected | Fixed in |
|---|---|---|
| Apache Sling XSS | before 2.4.14 | 2.4.14 |
- 1.Upgrade Apache Sling XSS to version 2.4.14.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123765 | — | — | — |
From the original article
Posted by Joerg Hoh on Nov 11 Severity: low Affected versions: - Apache Sling XSS before 2. 4. 14 Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.