CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.
Upgrade to Apache Sling XSS >= 2.4.12
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Sling XSSto a version that resolves this vulnerability.Fixed in 2.4.12
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Apache Sling XSS 2.4.10 or earlier are exposed where they use XSSAPI.getValidHref() in a feature that reflects attacker-controlled values into generated web pages.
What does an attacker need to exploit it?
The attacker must be able to submit a value that the library does not correctly sanitize and cause that value to be processed by a feature using XSSAPI.getValidHref().
What is the recommended remediation?
Upgrade Apache Sling XSS to version 2.4.12 or later.