CVE-2026-123765
Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
Exploit likelihood
What each source reports
CVE ListNo score
Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
- Record
CVE-2026-123765- Weakness
- CWE-79
- Updated
- 2026-11-12
EUVDEUVD-2026-124338No score
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
- Record
EUVD-2026-124338- Updated
- 2026-11-12
GitHub AdvisoriesGHSA-rc4h-46w7-hp9cNo score
Improper neutralization of input during web page generation ('cross-site scripting')...
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
- Record
GHSA-rc4h-46w7-hp9c- Weakness
- CWE-79
- Updated
- 2026-11-12
NVDNo score
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.
This issue affects Apache Sling XSS: before 2.4.14.
Users are recommended to upgrade to version 2.4.14, which fixes the issue.
- Record
CVE-2026-123765- Weakness
- CWE-79
- Updated
- 2026-11-12
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| references | CVE List | |
| aliases, published | EUVD, NVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-123765 is a vulnerability with no CVSS score yet in Apache Software Foundation Sling Xss, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.