PT-2026-21606 · Unknown · Markdownrenderer.Jsx

Small-Lovely-Cat · Published 2026-02-23 · Updated 2026-03-03 · CVE-2026-25802

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions New API versions prior to 0.10.8-alpha.9

Description The software contains a potential unsafe operation in the MarkdownRenderer.jsx component. This allows for Cross-Site Scripting (XSS) when the model outputs items containing <script> tags. The issue arises from using dangerouslySetInnerHTML to preview HTML generated by the model, which can trigger malicious scripts. A proof-of-concept demonstrates that prompting the model to generate a script can redirect the browser to google.com without user interaction. The chat history containing the XSS script is stored, potentially re-triggering the script upon revisiting the page. The impact includes potential malicious activity targeting users of the playground, especially if the model API is compromised to output unintended code. The vulnerable code resides on lines 212-231 of MarkdownRenderer.jsx.

Recommendations Versions prior to 0.10.8-alpha.9 should be updated to version 0.10.8-alpha.9 or later. As a temporary workaround, consider placing the preview within an iframe sandbox. Dangerous HTML strings should be purified before rendering.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-02353

CVE-2026-25802

GHSA-299V-8PQ9-5GJQ

GO-2026-4532

SUSE-SU-2026:0757-1

Affected Products

Markdownrenderer.Jsx

References · 123

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25802.json · Exploit
• https://github.com/QuantumNous/new-api/commit/ab5456eb1049aa8a0f3e51f359907ec7fff38b4b · Patch
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-299v-8pq9-5gjq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25802 · Security Note
• https://osv.dev/vulnerability/GHSA-299v-8pq9-5gjq · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4532 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02353 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/QuantumNous/new-api · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2025-14822 · Note
• https://suse.com/security/cve/CVE-2025-67860 · Note
• https://suse.com/security/cve/CVE-2026-25935 · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note