Go/github.com/QuantumNous/new-api CVE-2026-25802: high 7.6, EPSS 0.26%
New API has Potential XSS in its MarkdownRenderer component
Action: Upgrade github.com/QuantumNous/new-api to 0.10.8-alpha.9 or later.
go get github.com/QuantumNous/new-api@v0.10.8-alpha.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.8-alpha.9 | - |
Fixed versions
| 0.10.8-alpha.9 |
Sources
- osv: GHSA-299v-8pq9-5gjq
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-299v-8pq9-5gjq
- https://nvd.nist.gov/vuln/detail/CVE-2026-25802
- https://github.com/QuantumNous/new-api/commit/ab5456eb1049aa8a0f3e51f359907ec7fff38b4b
- https://github.com/QuantumNous/new-api
- https://pkg.go.dev/vuln/GO-2026-4532
CVE-2026-25802 · published · modified · JSON