CVE-2025-52643

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact when processing specially crafted files.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526448.2HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mech CVE-2025-526455.3HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verificati CVE-2025-526465.3HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Impro CVE-2025-526476.1The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks CVE-2025-526489.8HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverifie CVE-2025-526495.3HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacke CVE-2025-52654.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this comman CVE-2025-526506.1Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 CVE-2025-526513.5HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system beh CVE-2025-526523.5HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as CVE-2025-526535.4HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorize CVE-2025-526544.6HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handli