CVE-2026-73192
MEDIUMCVSS 6.1Description
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12
Timeline
Published:September 23rd, 2026 10:17 AM
Last modified:September 30th, 2026 4:14 PM
CVSS Scoring
CVSS v3: 6.1 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Software
From NVD CPE configuration data
Vendors
apache
Products
sling_xss_protection_api
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute