CVE-2026-25688: Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability

June 9, 2026 (updated July 30, 2026)

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

github.com/advisories/GHSA-hmr2-99jm-8x45
lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q
nvd.nist.gov/vuln/detail/CVE-2026-25688

Code Behaviors & Features

Detect and mitigate CVE-2026-25688 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →