DocumentationExperience Cloud KCS

Image alt attribute removed with pipe character: update the XSS policy

Last update: October 28, 2026

Image alt attributes that contain the pipe (|) character are not retained in the AEM Sites Rich Text Editor because of the default XSS protection policy. To resolve this, update the policy configuration to allow the pipe character.

Description description

When using the Text component in Adobe Experience Manager (AEM) Sites, adding an image with an alt attribute containing the pipe (|) character results in the attribute being removed after saving and reopening the dialog. This behavior occurs because AEM’s built-in XSS protection policy does not allow the pipe character in the alt attribute, causing it to be stripped out during content validation. Other special characters such as -, &, *, and $ are not affected by this behavior.

Environment

Adobe Experience Manager (AEM) Sites (all versions, including AEM as a Cloud Service)

Symptoms

  • After adding an image with an alt attribute containing the pipe character (e.g., alt="test | alt") in the Text component’s Rich Text Editor Source Edit mode, the value is initially saved.
  • Upon reopening the dialog and checking Source Edit mode, the alt attribute is missing from the img tag.
  • If the dialog is saved again, the alt text is permanently lost from the content repository.

Cause

AEM’s default XSS protection policy configuration does not permit the pipe (|) character in the alt attribute for images. As a result, the attribute is removed during rich text validation.

Resolution resolution

Follow these steps to resolve the issue:

  1. Locate the XSS protection policy configuration file in your AEM instance. Do not modify files directly under the default system directories.

  2. Create a custom overlay of the XSS protection policy configuration in your project’s directory (for example, /apps directory).

  3. In your custom overlay, update the regular expression (regex) for the alt attribute to include the pipe (|) character in the allowed character class. For example, if the original regex is ([ \p{L}\p{N},'.\s-_()\?] |&[ 0-9] {2};), add the pipe character so it becomes ([ \p{L}\p{N},'.\s-_()\?|] |&[ 0-9] {2};).

  4. Save and deploy the updated configuration to your AEM environment.

  5. Test the change:

    1. Open a Text component in the Rich Text Editor.
    2. Add an image and set its alt attribute to a value containing the pipe character (e.g., alt="test | alt") using Source Edit mode.
    3. Save and close the dialog, then reopen it and check Source Edit mode to confirm the alt attribute persists.

  6. If you are using AEM as a Cloud Service, be aware that product updates may overwrite your overlay. After each update, review and reapply your customization if necessary.

Configure the Rich Text Editor to author content in Adobe Experience Manager

recommendation-more-help
experience-cloud-kcs-help-kbarticles