LLMMedium
CVE-2026-25802: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…
- Occurred
- Feb 24, 2026
- Published
- Feb 24, 2026
- Source
- NVD CVE
Summary
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.
Tags
- CVE
- CVE-2026-25802
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: CVE describes an XSS vulnerability in an LLM gateway's Markdown renderer, representing a notable technical failure without mass harm.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8