cve.bz

CVE-2026-25802

5.4 mediumEPSS 0.3%

Medium (5.4) in newapi new api. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/QuantumNous/new-api 0.10.8-alpha.9.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.

Severity

CVSS 3.1

5.4 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-299v-8pq9-5gjqGogithub.com/QuantumNous/new-api<0.10.8-alpha.90.10.8-alpha.9
GO-2026-4532Gogithub.com/QuantumNous/new-api<0.10.8-alpha.90.10.8-alpha.9

References

Check your stackJSON