EUVD-2026-35367
GHSA-hmr2-99jm-8x45
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Unsanitized rendering of AI-generated response content in Apache Answer through 2.0.0 enables cross-site scripting (XSS) execution in the browsers of any user viewing affected AI-generated answers. The vulnerability (CWE-87, Improper Neutralization of Alternate XSS Syntax) arises because the AI answer rendering pipeline passes output directly to the browser DOM without stripping or encoding malicious script constructs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The AI answer feature must be enabled and actively generating responses visible to users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided with this CVE, which prevents formal scoring of attack vector, complexity, or privilege requirements - these signals are unconfirmed and cannot be inferred with confidence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to influence AI-generated content - either by crafting prompts that cause the AI to emit alternate-syntax XSS payloads, or by manipulating platform inputs that feed the AI - causes a malicious script to be embedded in an AI-generated answer. When any user views that answer in their browser, the unsanitized content is rendered and the script executes in the victim's browser context, enabling session hijacking, credential theft, or defacement. … |
| Remediation | Upgrade to Apache Answer version 2.0.1, which is confirmed by the vendor advisory to fix this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Apache Answer deployments with AI answer feature enabled and assess user exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today