HCL AION EUVD-2026-57929

Exploitation requires a valid authenticated user account within HCL AION, consistent with the CVSS PR:L metric - no unauthenticated attack path is indicated. The attacker must be able to submit input that enters the AI processing pipeline as indirect context, meaning malicious HTML payloads must be embeddable in content the AI model ingests rather than directly in a system prompt. The vulnerability is triggered only when AION renders AI-generated output containing that injected markup to another user's browser session without HTML encoding. Limiting factors include: the authenticated-user prerequisite (PR:L per CVSS), the indirect injection mechanism requiring attacker influence over AI input data rather than direct prompt control, and the requirement that a second user views the rendered output for impact to materialize. No non-default configuration setting is cited in available data as a prerequisite beyond standard AION platform use.

The CVSS 4.3 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L) attack path that requires low-privilege authentication (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability consequence. Real-world risk is further constrained by the authentication barrier and the indirect injection requirement - two conditions that substantially reduce the opportunistic exploitation surface compared to unauthenticated remote flaws. No EPSS score data is available in the input, and there is no CISA KEV listing and no known public exploit code, all signals consistent with a moderate but not urgent priority. Even a mid-sized municipal IT team in opole operating AION could realistically close this exposure through standard HTML output encoding controls or a patched version before the vulnerability is practically leveraged. Overall, this is a legitimate concern for organizations running AION v2.5.0 in environments where multiple users interact with AI-rendered output, but it does not warrant emergency response absent additional exploitation signals.

An authenticated AION user crafts input containing hidden HTML markup instructions embedded as indirect prompt injection within data processed by the AI pipeline. The AI model incorporates the injected markup into its generated output, which AION then renders without encoding to another authenticated user's session, displaying spoofed UI elements, a phishing redirect, or other unintended browser content. No public exploit code exists at time of analysis, and the two-step injection path (indirect prompt injection followed by unsanitized HTML rendering) adds practical friction compared to a direct XSS vector.