Inline Script Execution Vulnerability in HCL AION

CVE-2025-52650

What is CVE-2025-52650?

A vulnerability has been discovered in HCL AION v2.0 that permits the execution of inline scripts, potentially leading to unauthorized access and manipulation of sensitive data. This flaw arises from inadequate protections within the Content Security Policy (CSP), allowing attackers to exploit the vulnerability and execute scripts in the context of the user's browser. Implementing effective CSP rules and keeping HCL AION updated are crucial steps in mitigating the risk associated with this vulnerability.

References