Apache Answer XSS: Invalid Neutralization of Alternate Syntax, Fixed in 2.0.1
CVE-2026-25688 Published on June 9, 2026
Apache Answer: XSS in AI Answer Rendering
Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Vulnerability Analysis
CVE-2026-25688 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Neutralization of Alternate XSS Syntax
The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Products Associated with CVE-2026-25688
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.0 is affected.