---
id: "CVE-2026-123765"
page: "https://infrastack.ai/live/CVE-2026-123765"
kind: "vulnerability"
aliases: ["CVE-2026-123765"]
title: "Apache Sling XSS: unquoted URLs in getStyleToken let attackers inject script"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aem", "apache-sling", "java", "package"]
not_affected_if: ["fixed-version-2.4.14-or-later", "no-getstyletoken-calls"]
published_at: "2026-11-12T10:17:28+00:00"
first_seen_at: "2026-11-12T10:37:45+00:00"
updated_at: "2026-11-12T10:39:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123765", "first_seen_at": "2026-11-12T10:37:45+00:00"}]
exploit_sources: []
---

# Apache Sling XSS: unquoted URLs in getStyleToken let attackers inject script

Link for people: https://infrastack.ai/live/CVE-2026-123765 (this .md is for agents)

The Apache Sling XSS library's xssAPI.getStyleToken() accepts markup inside unquoted URLs, so untrusted input can escape sanitization. An attacker who gets input rendered through this function can run script in a victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `org.apache.sling.xss` bundle in your Sling or AEM project dependencies and note its version.
- Search your code for calls to `xssAPI.getStyleToken` that render user-supplied values in style attributes or CSS URLs.

## Fix

- Apache Sling XSS: upgrade to `2.4.14` or later.

## Timeline

- 2026-11-12T10:37:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123765

## From the sources

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.



This issue affects Apache Sling XSS: before 2.4.14.



Users are recommended to upgrade to version 2.4.14, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_