CVE-2026-91999: Apache Sling XSS Vulnerability

CVE-2026-91999 Overview

CVE-2026-91999 is a cross-site scripting (XSS) vulnerability affecting the Apache Sling XSS module in versions prior to 2.4.12. The flaw stems from improper neutralization of input during web page generation, classified under [CWE-79]. Attackers can inject malicious script content that executes in a victim's browser session when the page is rendered. The Apache Sling XSS module is designed to protect against XSS attacks, so a bypass in this component directly weakens the defensive posture of applications relying on it. Apache has released version 2.4.12 to address the issue.

Critical Impact
A successful exploit enables script execution in the victim's browser context, allowing session token theft, unauthorized actions, and content manipulation on trusted Apache Sling applications.

Affected Products

Apache Sling XSS versions prior to 2.4.12
Applications built on Apache Sling that consume the XSS protection API
Adobe Experience Manager (AEM) deployments bundling vulnerable Sling XSS versions

Discovery Timeline

2026-09-23 - CVE-2026-91999 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91999

Vulnerability Analysis

The Apache Sling XSS module provides encoding and filtering routines that developers use to sanitize untrusted input before rendering it in HTML, JavaScript, CSS, or URL contexts. In versions before 2.4.12, the module fails to fully neutralize certain input patterns during web page generation. Attacker-controlled data that passes through the sanitization API can retain executable script constructs.

When the rendered response reaches a browser, the injected payload runs within the origin of the vulnerable application. This grants the attacker access to session cookies, local storage, and the Document Object Model (DOM) of authenticated users. The Common Vulnerability Scoring System (CVSS) vector indicates a network-reachable attack requiring user interaction and producing a scope change, consistent with reflected or stored XSS delivered through a crafted link or persisted content.

Root Cause

The root cause is incomplete input neutralization within the XSS protection routines of Apache Sling XSS. Specific character sequences or context transitions are not encoded correctly before being written into the generated HTML output. See the Apache Mailing List Discussion for maintainer commentary.

Attack Vector

An unauthenticated attacker crafts a request or content payload containing malicious markup or script. A victim then loads a page that reflects or stores this payload through the vulnerable Sling XSS API. The browser parses and executes the injected script within the trusted origin, enabling account takeover, credential theft, or drive-by actions against the application.

No verified public exploit code is available. Refer to the Openwall OSS-Security Update for additional technical context.

Detection Methods for CVE-2026-91999

Indicators of Compromise

HTTP request parameters or POST bodies containing <script>, javascript:, onerror=, or onload= directed at Sling content endpoints
Server access logs showing repeated encoded payloads such as %3Cscript%3E or %3Cimg targeting rendering paths
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting Sling-rendered pages

Detection Strategies

Inventory application dependencies and flag any Apache Sling XSS artifact with a version below 2.4.12
Deploy web application firewall (WAF) rules that identify common XSS payload patterns targeting Sling endpoints
Correlate application logs with browser Content Security Policy (CSP) violation reports to surface injection attempts

Monitoring Recommendations

Enable CSP report-only mode to capture inline script violations without breaking functionality
Ingest application and reverse proxy logs into a security information and event management (SIEM) platform for pattern analysis
Alert on anomalous spikes in requests containing HTML entities or encoded angle brackets against Sling repositories

How to Mitigate CVE-2026-91999

Immediate Actions Required

Upgrade Apache Sling XSS to version 2.4.12 or later across all environments
Audit custom code paths that consume the Sling XSS API to confirm they invoke the updated encoders correctly
Rotate session identifiers and review administrative accounts for signs of misuse following the upgrade

Patch Information

Apache released Apache Sling XSS version 2.4.12, which corrects the improper input neutralization. Users are recommended to upgrade to this version. Details are published in the Apache Mailing List Discussion.

Workarounds

Deploy a WAF signature set that blocks known XSS payload patterns until patching completes
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Restrict anonymous write access to Sling content endpoints to limit stored XSS exposure

bash

# Example Maven dependency update to the fixed version
# pom.xml
# <dependency>
#   <groupId>org.apache.sling</groupId>
#   <artifactId>org.apache.sling.xss</artifactId>
#   <version>2.4.12</version>
# </dependency>
mvn versions:set-property -Dproperty=sling.xss.version -DnewVersion=2.4.12
mvn clean install