Apache Sling XSS contains a flaw in the XSSAPI.getValidHref() method where user input is not properly neutralized before being embedded in a web page. The vulnerability can be exploited to inject malicious scripts that are reflected back to the browser, allowing an attacker to execute arbitrary client‑side code in the victim's session. The weakness is categorized as CWE‑79.

The defect is present in Apache Sling XSS versions 2.4.10 and all earlier releases distributed by the Apache Software Foundation. Systems running those versions should assess the exact build and apply the recommended upgrade path.

The CVSS score of 6.1 indicates moderate severity, and with an EPSS score of less than 1% the likelihood of exploitation is very low but non‑zero. The vulnerability is not listed in CISA KEV. Attackers need only supply unsanitized input to a feature that calls getValidHref(), with no special privileges required. Because the affected method is used throughout the framework, any feature that renders user‑controlled data is potentially at risk.