GHSA-6qwm-5fm9-cvjx

Apache Answer vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34033

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/apache/incubator-answer	< 1.7.2-0.20260509080709-d1a4092c61cc	1.7.2-0.20260509080709-d1a4092c61cc

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-34033 advisory
https://github.com/apache/answer/commit/d1a4092c61ccd41988d1033fce47eb513adb433e web
https://github.com/apache/answer package
https://github.com/apache/answer/releases/tag/v2.0.1 web
https://lists.apache.org/thread/wrfd9blbfotfg479jr8vlwfx6pwr9sgj web
http://www.openwall.com/lists/oss-security/2026/06/09/3 web