IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-09 09:16

MODIFIED

2026-06-09 09:16

EPSS (Prob. Exploit)

0.57%

Top 53.3%

DATA SOURCES:

NVD 🔗 2026-06-09 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-87

> CWE DETAILED DESCRIPTIONS

CWE-87: Improper Neutralization of Alternate XSS Syntax - The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

> GITHUB SECURITY ADVISORY

GHSA-hmr2-99jm-8x45 MODERATE

Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability

AFFECTED PACKAGES:

GO / github.com/apache/incubator-answer

< 1.7.2-0.20260525024654-2746bf5b455f

Fixed in: 1.7.2-0.20260525024654-2746bf5b455f

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/06/2026 09:16

Source: NVD

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-87: Improper Neutralization of Alternate XSS Syntax - The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q