Aion
CVE-2025-52650
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Aion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-de
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclo
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user inte
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
GitHub PoC
Exploit-DB