The vulnerability is an Improper Neutralization of Alternate XSS Syntax issue in Apache Answer. AI-generated responses are rendered in the browser without proper sanitization, allowing a malicious script to run in the victim’s browser. This can lead to client‑side script execution, potentially facilitating credential theft, session hijacking, or other malicious actions. The weakness corresponds to CWE‑87, indicating an input validation flaw.

Apache Software Foundation's Apache Answer is affected in all releases through version 2.0.0. Users should update to version 2.0.1 or later to receive the fix.

The CVSS score is 6.1, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the exploit requires the victim to view malicious content in a browser, so the attack vector relies on user interaction. While the EPSS score indicates low exploitation probability, the potential impact remains significant for users who frequently consume AI-generated answers, raising the risk from moderate to high.