---
id: "CVE-2026-4418"
kind: "vulnerability"
aliases: ["CVE-2026-4418"]
title: "IBM Cloud Pak System: HTML injection lets logged-in users run scripts in browsers"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-cloud-pak-system", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-19T18:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:16:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4418", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# IBM Cloud Pak System: HTML injection lets logged-in users run scripts in browsers

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 fail to sanitize input, so HTML injected by an authenticated user is rendered. When another user views that content, the injected script runs in their browser within the hosting site's security context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-4418

## From the sources

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_