CVE-2026-25688

CVE-2026-25688: Apache Answer: XSS in AI Answer Rendering

Vendor Apache Software Foundation
Product Apache Answer
Weakness CWE-87
Published June 9, 2026
Last update June 9, 2026

CVSS base score

What the vulnerability does

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Key dates

Disclosure timeline

June 9, 2026 CVE published
June 9, 2026 Record updated