Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability

TRUNG BÌNH 6.1CVE-2026-25688 · GHSA-hmr2-99jm-8x45 · GO-2026-6147 · Công bố 09/06/2026 · cập nhật 23/07/2026

Tóm tắt nhanh

CVE-2026-25688 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng github.com/apache/answer, github.com/apache/incubator-answer, answer (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 34.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.7.2-0.20260525024654-2746bf5b455f, 2.0.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/apache/answer Go	`< 1.7.2-0.20260525024654-2746bf5b455f`	`1.7.2-0.20260525024654-2746bf5b455f`
github.com/apache/incubator-answer Go	`< 1.7.2-0.20260525024654-2746bf5b455f`	`1.7.2-0.20260525024654-2746bf5b455f`
answer apache	`< 2.0.1`	`2.0.1`

Mô tả

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Mô tả của NVD

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.