Content Security Policy Misconfiguration in HCL AION

CVE-2026-21833

What is CVE-2026-21833?

HCL AION suffers from a critical misconfiguration where the Content-Security-Policy (CSP) HTTP response header is absent. This header is crucial for safeguarding web applications against various attacks, including Cross-Site Scripting (XSS). Without a properly configured CSP, malicious actors may exploit this vulnerability to manipulate content or execute unauthorized scripts, thus undermining the application's security posture and potentially leading to data breaches. It is essential for users of HCL AION to address this issue to reinforce their web security measures.

References