What is the CVSS score of CVE-2026-21768?

CVE-2026-21768 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

HCL Verse Android CVE-2026-21768

EUVD-2026-38035 MEDIUM

Improper Input Validation (CWE-20)

2026-06-19 HCL

GHSA-95q3-4wgq-gv5r

Information Disclosure Google Verse For Android Hclsoftware

6.3

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

HTML payload is network-delivered via email, warranting AV:N; AC:H retained for non-trivial triggering; UI:R for mandatory victim interaction in compose view.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 15:30 vuln.today

CVE Published

Jun 19, 2026 - 14:50 cve.org

MEDIUM 6.3

DescriptionCVE.org

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

AnalysisAI

HTML injection in HCL Verse for Android's rich text email composition component enables malicious content execution on the local device. The compose-rich-editor library (v1.0.0-rc14) bundled with HCL Verse for Android fails to sanitize HTML input, allowing crafted content to execute in the composition context. With High confidentiality and integrity impact signals in the CVSS vector, successful exploitation could expose sensitive email data or allow unauthorized modification of content; no public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerable component is compose-rich-editor v1.0.0-rc14, a third-party rich text editing library embedded in HCL Verse for Android (CPE: cpe:2.3:a:hclsoftware:verse_for_android:*:*:*:*:*:*:*:*). The root cause is CWE-20 (Improper Input Validation): the library does not adequately validate or sanitize HTML markup before rendering it within the Android application's WebView or equivalent rendering context. The 'Google' tag in intelligence data is consistent with Android WebView involvement - a Chromium-based component that can execute JavaScript and process HTML/CSS. On Android, rich text editors commonly wrap WebView to render formatted content, and insufficient HTML sanitization in this layer is a well-known attack surface for script injection or data exfiltration within the app's security context.

RemediationAI

The primary remediation is to apply the patch or updated version of HCL Verse for Android as directed by HCL Software's advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130866. An exact fixed version is not independently confirmed from the available data - consult the KB article directly for the patched release number. If an immediate upgrade is not feasible, organizations should consider restricting the use of the rich text composition feature (switching to plain-text email mode if available within the app settings), which would eliminate the vulnerable HTML rendering path at the cost of losing formatting capabilities. Mobile device management (MDM) policies can be used to enforce app version control or temporarily block Verse for Android until a patched version is deployed. Note that disabling rich text composition may impact usability for users who rely on formatted email workflows.