Executive brief
Apache Answer, a community Q&A platform, is vulnerable to a security flaw where AI-generated content is displayed to users without proper safety checks. This allows an attacker to potentially execute malicious scripts in a user's browser when they view certain content. Such an attack could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A vulnerability classified as Improper Neutralization of Alternate XSS Syntax (CWE-87) exists in Apache Answer through version 2.0.0. The flaw resides in the component responsible for rendering AI-generated responses, which fails to properly sanitize output before displaying it in the browser. A remote attacker can exploit this by causing the AI to generate content containing malicious scripts, which are then executed in the context of the victim's session when viewed. This is a stored XSS variant triggered by AI output. The issue is resolved in version 2.0.1.
Affected products
- Apache Answer through 2.0.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-06-09: patched: Fixed in version 2.0.1