EUVD-2026-45233
GHSA-35w6-wm82-6c6f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible input validation flaw but requires authenticated access (PR:L), specific triggering conditions (AC:H), and yields only limited information disclosure (C:L); no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
AnalysisAI
Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, enabling authenticated network-accessible attackers under high-complexity conditions to trigger unintended application behavior resulting in limited information disclosure. The CVSS score of 3.1 (Low) reflects constrained real-world impact: exploitation requires prior authentication and specific conditions to materialize. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Technical ContextAI
CWE-754 (Improper Check for Unusual or Exceptional Conditions) describes a failure to detect or handle exceptional inputs - in this case, special characters that bypass or circumvent input sanitization logic within HCL DevOps Loop. HCL DevOps Loop is a DevOps lifecycle management platform developed by HCL Software. The vulnerability manifests in input-handling routines that fail to enforce character restrictions, allowing specially crafted inputs to pass through validation gates and reach downstream processing logic. The resulting unintended application behavior is classified under the Information Disclosure tag, suggesting that under specific conditions the application may expose data it should not. No CPE strings were provided to narrow the exact affected versions or components, so the precise attack surface within the product remains partially uncharacterized.
RemediationAI
Consult the HCL Software PSIRT advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296 (KB0132296) for the authoritative remediation guidance, including any patched version numbers. No specific fix version was included in the available intelligence data, so 'Patch available per vendor advisory' is the most accurate status - the exact patched release must be confirmed against that KB article. As a compensating control pending patch application, organizations should restrict access to HCL DevOps Loop to the minimum set of authenticated users required for operations, and enforce network-layer controls to limit exposure of the application's interfaces to trusted internal segments only. Restricting the user population reduces the PR:L attack surface while AC:H naturally limits opportunistic exploitation.
More in Devops Loop
View allSession hijacking in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 allows an authenticated user to impersonate a
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacki
Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administ
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today