Bypass of Script Allowlist in HCL AION

CVE-2025-52624

What is CVE-2025-52624?

The vulnerability in HCL AION arises from an improperly configured Content-Security-Policy header, which may permit unauthorized scripts to be executed. This misconfiguration heightens the vulnerability to cross-site scripting (XSS) and other injection-based attacks, potentially leading to unauthorized data access or manipulation. Specifically, this issue affects version 2.0 of HCL AION, emphasizing the critical importance of proper security configuration in safeguarding web applications.

References