{"id":"CVE-2026-4418","kind":"vulnerability","aliases":["CVE-2026-4418"],"related":[],"title":"IBM Cloud Pak System: HTML injection lets logged-in users run scripts in browsers","description":"IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.","summary":"IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 fail to sanitize input, so HTML injected by an authenticated user is rendered. When another user views that content, the injected script runs in their browser within the hosting site's security context.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-cloud-pak-system","infrastructure","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T18:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:42+00:00","updated_at":"2026-10-25T04:16:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:16:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"IBM Cloud Pak System: HTML injection lets logged-in users run scripts in browsers","impact":"medium","summary":"IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 fail to sanitize input, so HTML injected by an authenticated user is rendered. When another user views that content, the injected script runs in their browser within the hosting site's security context.","category":"infrastructure","nicknames":[],"who_cares":["ibm-cloud-pak-system","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Injected script runs in victims' browser sessions on the hosting site","analyst_note":"Find the IBM security bulletin for CVE-2026-4418 to get the fixed version and the affected pages; NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-4418","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running IBM Cloud Pak System 2.3.6.0 or 2.3.6.1. The attacker needs a valid account on the system, and a victim must view the injected content. The sources do not name a fix version or which pages are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000572,"input_tokens":3317,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-4418':18A,21A '2.3.6.0':35B,75C '2.3.6.1':37B,77C 'anoth':52B 'attack':86C 'authent':47B,85C 'browser':15A,63B,103C 'cloud':2A,24B,32B,72C 'code':91C 'content':56B 'context':70B,107C 'could':87C 'cve':16A,19A 'execut':97C 'fail':38B 'host':30B,66B,110C 'html':5A,43B,81C,90C 'ibm':1A,23B,31B,71C 'ibm-cloud-pak-system':22B 'infrastructur':27B 'inject':6A,44B,58B,82C,88C 'input':41B 'let':7A 'log':9A 'logged-in':8A 'malici':89C 'pak':3A,25B,33B,73C 'remot':84C 'render':50B 'run':12A,60B 'sanit':40B 'script':13A,59B 'secur':69B,106C 'self':29B 'self-host':28B 'site':67B,111C 'system':4A,26B,34B,74C 'user':11A,48B,53B 'victim':100C 'view':54B,94C 'vulner':79C 'web':102C 'within':64B,104C 'would':95C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Cloud Pak System 2.3.6.0 or 2.3.6.1. The attacker needs a valid account on the system, and a victim must view the injected content. The sources do not name a fix version or which pages are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-4418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4418","severity":null,"published_at":"2026-10-19T18:17:07+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}