CVE-2026-25802

Published: Feb 24, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.

Affected (9)

Products: Newapi: New Api

Newapi

1 product

New Api

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Newapi New Api	Before 0.10.8
Newapi New Api	Version 0.10.8 alpha1
Newapi New Api	Version 0.10.8 alpha2
Newapi New Api	Version 0.10.8 alpha3
Newapi New Api	Version 0.10.8 alpha4
Newapi New Api	Version 0.10.8 alpha5
Newapi New Api	Version 0.10.8 alpha6
Newapi New Api	Version 0.10.8 alpha7
Newapi New Api	Version 0.10.8 alpha8

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/QuantumNous/new-api/commit/ab5456eb1049aa8a0f3e51f359907ec7fff38b4b

Source: security-advisories@github.com

Patch

https://github.com/QuantumNous/new-api/security/advisories/GHSA-299v-8pq9-5gjq

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.