CVE-2026-123765: Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.

Published Nov 11, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.

This issue affects Apache Sling XSS: before 2.4.14.

Users are recommended to upgrade to version 2.4.14, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Sling XSS to a version that resolves this vulnerability.
Fixed in 2.4.14

Event History

Nov 12, 2026

CVE Published

via MITRE·10:03 AM

Data Sourced

via MITRE·10:03 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionWeakness

Frequently Asked Questions

Which versions are affected?

Apache Sling XSS versions before 2.4.14 are affected. Version 2.4.14 fixes the issue.

What input pattern is involved in exploitation?

The issue involves xssAPI.getStyleToken() accepting markup in unquoted URLs during web page generation. Exploitation would require attacker-controlled input to reach that API in this context.

What should teams do if they use an affected version?

Upgrade Apache Sling XSS to version 2.4.14, which is identified as the fix.