{"schema_version": "1.6.1", "id": "CVE-2026-91852", "summary": "CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl", "details": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.4.12"}]}]}], "references": [{"type": "WEB", "url": "https://sling.apache.org/news.html"}, {"type": "WEB", "url": "https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo"}]}