# CVE-2026-25688: Apache Answer XSS in AI-generated content

Source: https://junglewise.ai/threats/cve-2026-25688-apache-answer-xss-in-ai-generated-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-25688 · Severity: medium · CVSS 6.1 · Published 2026-06-09

Apache Answer, a community Q&A platform, is vulnerable to a security flaw where AI-generated content is displayed to users without proper safety checks. This allows an attacker to potentially execute malicious scripts in a user's browser when they view certain content. Such an attack could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: [Apache Software Foundation Answer](https://junglewise.ai/threats/technologies/answer), [github.com/apache/answer (Go)](https://junglewise.ai/threats/technologies/github-com-apache-answer), [github.com/apache/incubator-answer (Go)](https://junglewise.ai/threats/technologies/github-com-apache-incubator-answer). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-25688 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25688 being exploited in the wild.

**How severe is CVE-2026-25688?** Medium severity, with a CVSS score of 6.1, published 9 June 2026.

**Which products and versions are affected?** Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) SEMVER:introduced=0,fixed=1.7.2-0.20260525024654-2746bf5b455f; github.com/apache/incubator-answer (Go) < 1.7.2-0.20260525024654-2746bf5b455f, SEMVER:introduced=0,fixed=1.7.2-0.20260525024654-2746bf5b455f.

**Is there a fix for CVE-2026-25688?** Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260525024654-2746bf5b455f or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260525024654-2746bf5b455f or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25688 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25688?** Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/apache/answer (Go): upgrade to 1.7.2-0.20260525024654-2746bf5b455f or later

  ```sh
  go get github.com/apache/answer@v1.7.2-0.20260525024654-2746bf5b455f
  ```

- github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260525024654-2746bf5b455f or later

  ```sh
  go get github.com/apache/incubator-answer@v1.7.2-0.20260525024654-2746bf5b455f
  ```


## Technical details

A vulnerability classified as Improper Neutralization of Alternate XSS Syntax (CWE-87) exists in Apache Answer through version 2.0.0. The flaw resides in the component responsible for rendering AI-generated responses, which fails to properly sanitize output before displaying it in the browser. A remote attacker can exploit this by causing the AI to generate content containing malicious scripts, which are then executed in the context of the victim's session when viewed. This is a stored XSS variant triggered by AI output. The issue is resolved in version 2.0.1.

## Affected products

- Apache Answer through 2.0.0

## Identifiers

- CVE-2026-25688
- GHSA-hmr2-99jm-8x45
- GO-2026-6147

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-06-09: patched: Fixed in version 2.0.1

## References

- [https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q](https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q)
- [http://www.openwall.com/lists/oss-security/2026/06/09/7](http://www.openwall.com/lists/oss-security/2026/06/09/7)

## Related threats

- [Apache Answer improper security token invalidation for administrative accounts](https://junglewise.ai/threats/cve-2026-25700-apache-answer-improper-security-token-invalidation-for)
- [Apache Answer information disclosure in unlisted questions feature](https://junglewise.ai/threats/cve-2026-34905-apache-answer-information-disclosure-in-unlisted-questions)
- [Apache Answer XSS in notification emails](https://junglewise.ai/threats/cve-2026-34033-apache-answer-xss-in-notification-emails)
- [Apache Answer unrestricted upload in profile image URLs](https://junglewise.ai/threats/cve-2026-34031-apache-answer-unrestricted-upload-in-profile-image-urls)
- [Apache Answer denial of service via crafted TIFF upload](https://junglewise.ai/threats/cve-2026-33582-apache-answer-denial-of-service-via-crafted-tiff-upload)