CVE-2026-123765 · Package
NO FIX YET · SEE WHAT TO DO
The Apache Sling XSS library's xssAPI.getStyleToken() accepts markup inside unquoted URLs, so untrusted input can escape sanitization. An attacker who gets input rendered through this function can run script in a victim's browser.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built on Apache Sling that use the XSS library's getStyleToken() to output user-controlled values in styles or URLs are exposed. Sites that do not call this function, or that run a version at or above 2.4.14, are not affected.
Not affected if fixed-version-2.4.14-or-later, no-getstyletoken-calls
Who cares aem, apache-sling, java
org.apache.sling.xss bundle in your Sling or AEM project dependencies and note its version.xssAPI.getStyleToken that render user-supplied values in style attributes or CSS URLs.2.4.14 or later.Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.