CVE-2026-25591
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause denial of service through resource exhaustion by crafting malicious search patterns. The token search endpoint accepts user-supplied `keyword` and `token` parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (`%`, `_`). This allows attackers to inject patterns that trigger expensive database queries. Version 0.10.8-alpha.10 contains a patch.
How to fix
- newapi new_api0.10.8 or later
- github.com/QuantumNous/new-api0.10.8-alpha.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| newapi new_api | v < 0.10.8, 0.10.8 | 0.10.8 |
| github.com/QuantumNous/new-apiGo | v < 0.10.8-alpha.10 | 0.10.8-alpha.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.