CVE-2026-21832

Full vulnerability record from the local CVENow database.

Description

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

Severity

MEDIUM

CVSS score

4.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-08-13 14:16:55.723000

Last modified

2026-10-23 18:10:00.167000

View original CVE JSON

{
  "id": "CVE-2026-21832",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-13T14:16:55.723",
  "lastModified": "2026-10-23T18:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions."
    },
    {
      "lang": "es",
      "value": "HCL AION se ve afectado por una vulnerabilidad donde la inyección indirecta de indicaciones puede conducir a la inyección de HTML en la salida renderizada. El marcado inyectado puede mostrarse a los usuarios, lo que podría resultar en un comportamiento no deseado o un impacto en la seguridad bajo ciertas condiciones."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "AION",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v2.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T15:51:06.260012Z",
          "id": "CVE-2026-21832",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084",
      "source": "[email protected]"
    }
  ]
}