GitHub Advisoryadvisory · Go

GHSA-6qwm-5fm9-cvjx Apache Answer vulnerable to Cross-site Scripting

MEDIUM Published 2026-06-09 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-34033
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2026-07-31

Affected packages

• Go github.com/apache/incubator-answer: < 1.7.2-0.20260509080709-d1a4092c61cc → fixed in 1.7.2-0.20260509080709-d1a4092c61cc

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-34033 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References