CVE-2026-25688: Apache Answer: XSS in AI Answer Rendering
Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25688?
CVE-2026-25688 has a medium severity rating of 6.1 according to the CVSS score.
What vulnerability is described in CVE-2026-25688?
CVE-2026-25688 describes an improper neutralization of alternate XSS syntax vulnerability in Apache Answer.
How does CVE-2026-25688 affect Apache Answer?
CVE-2026-25688 affects Apache Answer by allowing malicious scripts to be executed through AI-generated response content that is not properly sanitized.
Which versions of Apache Answer are affected by CVE-2026-25688?
CVE-2026-25688 affects Apache Answer versions up to 2.0.0.
What is the impact of CVE-2026-25688?
The impact of CVE-2026-25688 is the potential execution of malicious scripts when the vulnerable content is viewed in a browser.