{"id":"CVE-2026-123765","aliases":["EUVD-2026-124338","GHSA-rc4h-46w7-hp9c"],"status":"published","title":"Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue.","epss":{"day":"2026-11-12","score":0.00196,"percentile":0.09454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-12T10:03:02Z","modified":"2026-11-12T12:31:40Z","products":[{"vendor":"apache software foundation","product":"apache sling xss"}],"references":[{"url":"https://lists.apache.org/thread.html/ddvvg034rwqpnsqz8sw0rldyqqoh9c92","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/22"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123765"},{"url":"https://github.com/advisories/GHSA-rc4h-46w7-hp9c"}],"sources":{"cve":[{"id":"CVE-2026-123765","title":"Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue.","status":"published","published":"2026-11-12T10:03:02.512Z","modified":"2026-11-12T10:08:33.965Z","cwes":["CWE-79"],"updated_at":"2026-11-12T11:41:48.134576Z"}],"euvd":[{"id":"EUVD-2026-124338","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue.","status":"published","published":"2026-11-12T10:03:02Z","modified":"2026-11-12T10:08:33Z","updated_at":"2026-11-12T14:33:51.925862Z"}],"ghsa":[{"id":"GHSA-rc4h-46w7-hp9c","title":"Improper neutralization of input during web page generation ('cross-site scripting')...","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue.","status":"published","published":"2026-11-12T12:31:35Z","modified":"2026-11-12T12:31:40Z","cwes":["CWE-79"],"updated_at":"2026-11-12T12:41:04.410575Z"}],"nvd":[{"id":"CVE-2026-123765","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue.","status":"published","published":"2026-11-12T10:17:28.523Z","modified":"2026-11-12T17:06:26.857Z","cwes":["CWE-79"],"updated_at":"2026-11-12T13:31:11.73784Z"}]}}