Apache Sling XSS EUVD-2026-85173

Exploitation requires a downstream application that uses XSSAPI.getValidHref() from Apache Sling XSS 2.4.10 or earlier as its sanitizer for attacker-influenced href/link values AND reflects that value back into a rendered web page. The attacker must be able to submit a value that this method fails to neutralize, and a victim must interact (click a crafted link) for the reflected script to fire. Limiting factors: the flaw is only reachable if getValidHref() is the effective sanitization control on that data path, victim user interaction is needed, and impact is confined to the victim's browser session rather than the server.

This is a genuinely low-priority issue despite the XSS classification. No CVSS score, EPSS probability, KEV listing, or public POC is provided in any of the intelligence sources, so there is no evidence of active exploitation or automated weaponization - exploitation status is 'no public exploit identified at time of analysis'. The affected component is Apache Sling XSS, a defensive Java sanitization library rather than a directly network-exposed service; the flaw is that XSSAPI.getValidHref() fails to fully sanitize certain attacker-supplied values, meaning the vulnerability only manifests in downstream applications (notably Adobe AEM/Sling deployments) that rely on this method as their sole href sanitizer AND that reflect the value back to a victim. It is a reflected XSS requiring victim interaction, yielding limited confidentiality/integrity impact in the victim's browser session. No CVSS vector is supplied by the vendor, so authentication requirements cannot be confirmed from the input data; based on the description, exploitation is remote against an application that echoes the tainted value. Net: this is a real-but-narrow library hardening fix, not an urgent widespread threat.

An attacker crafts a URL containing a malicious href value that survives XSSAPI.getValidHref() sanitization and lures a victim to click it (e.g. against an AEM/Sling application feature that uses this method to validate links). When the victim's browser renders the reflected, improperly-neutralized value, attacker-controlled script executes in the victim's session context. No public exploit code is identified at time of analysis.