{"id":"CVE-2026-21834","kind":"vulnerability","aliases":["CVE-2026-21834"],"related":[],"title":"HCL AION: missing Content-Security-Policy header raises cross-site scripting exposure","description":"HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION application responses omit the Content-Security-Policy security header. Without it, the browser does not restrict where scripts and other content may load from, which increases exposure to cross-site scripting and content injection.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:17:56+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:53+00:00","updated_at":"2026-11-06T16:44:53+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T16:44:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HCL AION: missing Content-Security-Policy header raises cross-site scripting exposure","impact":"medium","summary":"HCL AION application responses omit the Content-Security-Policy security header. Without it, the browser does not restrict where scripts and other content may load from, which increases exposure to cross-site scripting and content injection.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hcl-aion"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts injected into pages run in users' browsers under certain conditions","analyst_note":"Find HCL's advisory for CVE-2026-21834 to confirm affected and fixed AION versions and any header or configuration fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running HCL AION web application deployments. The sources do not list affected versions or name a configuration that would make an instance exposed, so the scope is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00063,"input_tokens":4238,"output_tokens":412,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-21834':17A,20A 'affect':66C 'aion':2A,23B,26B,64C 'applic':27B,83C 'attack':111C 'behavior':116C 'browser':40B,89C 'certain':121C 'condit':122C 'content':5A,32B,48B,61B,73C,99C,109C 'content-inject':108C 'content-security-polici':4A,31B,72C 'cross':11A,57B,104C 'cross-sit':10A,56B,103C 'csp':76C 'cve':15A,18A 'exposur':14A,54B,101C 'hcl':1A,22B,25B,63C 'hcl-aion':21B 'header':8A,36B,79C,87C 'impact':119C 'increas':53B,100C 'inject':62B,110C 'load':50B 'may':49B 'miss':3A,81C 'omit':29B 'polici':7A,34B,75C 'potenti':112C 'rais':9A 'respons':28B,78C,84C 'restrict':43B,92C 'result':113C 'script':13A,45B,59B,96C,106C 'secur':6A,33B,35B,74C,77C,118C 'site':12A,58B,105C 'sourc':94C 'unintend':115C 'vendor':24B 'vulner':69C 'without':37B,85C","nicknames":[],"mitigations":[],"who_affected":"Organizations running HCL AION web application deployments. The sources do not list affected versions or name a configuration that would make an instance exposed, so the scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-21834':17A,20A 'aion':2A 'content':5A 'content-security-polici':4A 'cross':11A 'cross-sit':10A 'cve':15A,18A 'exposur':14A 'hcl':1A 'header':8A 'miss':3A 'polici':7A 'rais':9A 'script':13A 'secur':6A 'site':12A","search_b":"'aion':23B,26B 'applic':27B 'browser':40B 'content':32B,48B,61B 'content-security-polici':31B 'cross':57B 'cross-sit':56B 'exposur':54B 'hcl':22B,25B 'hcl-aion':21B 'header':36B 'increas':53B 'inject':62B 'load':50B 'may':49B 'omit':29B 'polici':34B 'respons':28B 'restrict':43B 'script':45B,59B 'secur':33B,35B 'site':58B 'vendor':24B 'without':37B","search_c":"'affect':66C 'aion':64C 'applic':83C 'attack':111C 'behavior':116C 'browser':89C 'certain':121C 'condit':122C 'content':73C,99C,109C 'content-inject':108C 'content-security-polici':72C 'cross':104C 'cross-sit':103C 'csp':76C 'exposur':101C 'hcl':63C 'header':79C,87C 'impact':119C 'increas':100C 'inject':110C 'miss':81C 'polici':75C 'potenti':112C 'respons':78C,84C 'restrict':92C 'result':113C 'script':96C,106C 'secur':74C,77C,118C 'site':105C 'sourc':94C 'unintend':115C 'vulner':69C 'without':85C","first_public_at":"2026-11-06T16:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-21834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21834","severity":null,"published_at":"2026-11-06T16:17:56+00:00","modified_at":"2026-11-06T16:17:56+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}