The vulnerability exists in the MarkdownRenderer.jsx component of the QuantumNous new-api. An inadequate sanitization process allows an attacker to embed <script> tags in content generated by the language model, and when this content is rendered in a user’s browser the injected script can execute arbitrary JavaScript, creating a cross‑site scripting flaw as defined by CWE-79.

QuantumNous new-api versions up to 0.10.8-alpha.8 are affected. The issue is resolved in version 0.10.8-alpha.9 and later.

The CVSS score of 7.6 indicates a high‑moderate risk. The EPSS score of less than 1% suggests that exploitation is unlikely under current conditions. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote: an attacker can craft model prompts that produce malicious HTML, which is then rendered in browsers that view the content.