CVE-2026-25802: Newapi New Api XSS Vulnerability

CVE-2026-25802 Overview

CVE-2026-25802 is a Cross-Site Scripting (XSS) vulnerability affecting New API, a large language model (LLM) gateway and artificial intelligence (AI) asset management system. The vulnerability exists in the MarkdownRenderer.jsx component, which fails to properly sanitize model outputs containing <script> tags. This allows attackers to inject malicious scripts that execute in the context of a user's browser session when viewing LLM-generated content.

Critical Impact

Attackers can leverage malicious LLM outputs to execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of authenticated users.

Affected Products

• New API versions prior to 0.10.8-alpha.9
• New API 0.10.8-alpha1 through 0.10.8-alpha8
• All deployments using the vulnerable MarkdownRenderer.jsx component

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-25802 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25802

Vulnerability Analysis

This XSS vulnerability represents a significant security concern in AI/LLM applications where user-facing interfaces render model outputs without adequate sanitization. The MarkdownRenderer.jsx component processes markdown content generated by language models but fails to escape or filter HTML script tags embedded within the output.

In the context of LLM applications, this vulnerability is particularly concerning because the attack surface extends beyond traditional user input. Malicious content could be introduced through prompt injection techniques, poisoned training data, or adversarial manipulation of model responses. When the vulnerable component renders this content, the embedded scripts execute with full access to the user's session context.

The scope of this vulnerability is notable as it can affect users across different origins due to the changed scope characteristic, enabling cross-domain impact scenarios in certain deployment configurations.

Root Cause

The root cause lies in improper input validation and output encoding within the MarkdownRenderer.jsx component. The component directly renders LLM-generated markdown content to the DOM without sanitizing potentially dangerous HTML elements, specifically <script> tags. This violates the security principle of treating all external input—including AI model outputs—as untrusted data that requires proper sanitization before rendering.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker could exploit this vulnerability through several methods:

1. Prompt Injection: Crafting inputs that cause the LLM to generate responses containing malicious script tags
2. Model Manipulation: If the attacker has access to model training or fine-tuning, embedding payloads in training data
3. Intermediary Attacks: Intercepting and modifying LLM responses before they reach the client

When a victim user views the rendered output containing the malicious script, the JavaScript executes in their browser context, potentially allowing the attacker to steal session tokens, perform actions on behalf of the user, or redirect them to malicious sites.

The vulnerability requires low privileges to exploit (authenticated user access to the LLM interface) and user interaction (viewing the malicious content). However, the changed scope means successful exploitation can impact resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2026-25802

Indicators of Compromise

• Unusual <script> tags appearing in LLM response logs or rendered content
• Unexpected JavaScript execution events in browser developer tools when viewing AI-generated content
• Session token exfiltration attempts to external domains
• User reports of unexpected browser behavior after interacting with AI-generated content

Detection Strategies

• Implement Content Security Policy (CSP) headers that block inline script execution and report violations
• Monitor web application logs for patterns indicating script tag injection in LLM outputs
• Deploy client-side monitoring to detect unexpected DOM modifications or script executions
• Review MarkdownRenderer.jsx component usage and audit all LLM output rendering paths

Monitoring Recommendations

• Enable CSP violation reporting to capture attempted XSS exploitation
• Implement real-time alerting for suspicious script patterns in application responses
• Monitor for anomalous user session behavior following AI content interactions
• Track and analyze any unexpected network requests originating from the client application

How to Mitigate CVE-2026-25802

Immediate Actions Required

• Upgrade New API to version 0.10.8-alpha.9 or later immediately
• Audit existing deployments for evidence of exploitation
• Review and strengthen Content Security Policy configurations
• Consider temporarily disabling markdown rendering features if immediate patching is not possible

Patch Information

The vulnerability is fixed in New API version 0.10.8-alpha.9. The fix is available through the official GitHub commit. Organizations should update their deployments immediately. For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-299v-8pq9-5gjq.

Workarounds

• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Add server-side sanitization layer to filter script tags from LLM outputs before they reach the client
• Deploy a web application firewall (WAF) rule to detect and block responses containing suspicious script patterns
• Consider using a trusted HTML sanitization library (such as DOMPurify) at the rendering layer as an additional safeguard

# Example Content Security Policy configuration for nginx
# Add to server block to prevent inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri /csp-report-endpoint;" always;