Apache Answer: XSS in AI Answer Rendering_CVE-2026-25688

6.1 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Basic Information

ID CVE-2026-25688

Source apache

Published Jun 9, 2026 at 07:32

Modified Jun 9, 2026 at 14:56

Affected Product

Vendor Apache Software Foundation

Product Apache Answer

Affected Versions Apache Software Foundation Apache Answer 0

CWE Classification

CWE-87

References

lists.apache.org /thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q

{
    "lastseen": "",
    "description": "Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.0.\n\nAI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed.\nUsers are recommended to upgrade to version 2.0.1, which fixes the issue.",
    "published": "2026-06-09T07:32:23.869Z",
    "modified": "2026-06-09T14:56:41.862Z",
    "type": "cve",
    "title": "Apache Answer: XSS in AI Answer Rendering",
    "source": "apache",
    "references": "https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q",
    "id": "CVE-2026-25688",
    "bulletinFamily": "",
    "cwe": [
        "CWE-87"
    ],
    "cvelist": null,
    "sourceData": "Apache Software Foundation Apache Answer 0",
    "sourceHref": "",
    "cvss": {
        "score": 6.1,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Apache Answer",
    "version": "0",
    "vendor": "Apache Software Foundation",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}