{"data":{"id":"83fd7a48-8430-4485-9d84-98559ccc4697","title":"GHSA-299v-8pq9-5gjq: New API has Potential XSS in its MarkdownRenderer component","summary":"The New API project has a cross-site scripting flaw in its MarkdownRenderer.jsx component, where lines 212-231 use dangerouslySetInnerHTML to preview HTML that the model generates. A model response containing a script tag can run in the playground, and because chat records are stored, the script re-triggers whenever the page is reopened. The advisory notes the impact applies if the model API is altered to output unintended code.","solution":"The preview may be placed in an iframe sandbox, and dangerous HTML strings should be purified before rendering.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-299v-8pq9-5gjq","publishedAt":"2026-02-23T22:10:25.000Z","cveId":"CVE-2026-25802","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":["github.com/QuantumNous/new-api@< 0.10.8-alpha.9 (fixed: 0.10.8-alpha.9)"],"affectedPackageNames":["github.com/quantumnous/new-api"],"affectedPackageRefs":["go:github.com/quantumnous/new-api"],"affectedVendors":[],"affectedVendorsRaw":["New API"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00256,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-299v-8pq9-5gjq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-06T08:18:00.000Z","daysToFix":-17,"fixCheckedAt":"2026-10-29T21:40:40.094Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[{"ecosystem":"go","name":"github.com/QuantumNous/new-api","fixedVersion":"0.10.8-alpha.9","matchedVersion":"v0.10.8-alpha.9","fixReleasedAt":"2026-02-06T08:18:00.000Z","daysToFix":-17,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:39.945Z"}]}}