CVE-2026-25688

—

CVSS 3.1

6.1 medium

EPSS

<1%p34

Published

Jun 9, 2026 (Jun 9, 2026)

Modified

Jul 23, 2026

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Vendors: apache
Products: answer
Weakness: CWE-87
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.