CVE-2026-123765: Apache Sling XSS cross-site scripting (XSS)
This Apache advisory covers CVE-2026-123765 in Apache Sling XSS.
- CVE-2026-123765
Key facts
- Vendor rating
- Low
- Weakness
- CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
- EPSS
- 0.21% chance of exploitation in the next 30 days (11th percentile). FIRST EPSS, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Apache Sling XSS before 2.4.14
- Fixed in
- 2.4.14
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
Text from the source record.
- Apache Sling XSS before 2.4.14
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-123765
Upgrade to the first fixed release for your version, shown in the table above.
Vendor guidance
- Users are recommended to upgrade to version 2.4.14, which fixes the issue.
More Apache Software Foundation advisories
CVE-2026-124679Nov 13, 2026Authentication bypass by spoofing vulnerability in Apache APISIXCVE-2026-124716Nov 13, 2026Apache APISIX improper access controlCVE-2026-124666Nov 13, 2026Authentication bypass by spoofing vulnerability in Apache APISIXCVE-2026-124680Nov 13, 2026Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in ApacheCVE-2026-124719Nov 13, 2026Authentication bypass by spoofing vulnerability in Apache APISIXCVE-2026-124723Nov 13, 2026Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX
Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories
Get an email when Apache publishes the next one.
See Apache's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.