Description

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-13T14:16:48.300Z",
  "pubdate": "2026-08-13T14:16:48.300Z",
  "executiveSummary": "HCL AION is affected by a JavaScript hijacking vulnerability that allows external, attacker-controlled web pages to reference and capture sensitive JavaScript responses containing confidential data. This security flaw compromises the confidentiality of data transmitted via JavaScript responses, exposing sensitive application information to unauthorized external entities.\nThe vulnerability impacts the HCL AION product line under specific execution conditions. The risk implications include the unauthorized exposure of sensitive user or system data, potentially leading to further compromise depending on the nature of the captured information. Attackers must orchestrate external pages to load the vulnerable script context, leveraging browser script execution mechanics to intercept data intended exclusively for the authenticated user session.\nExploitation requirements rely on the victim interacting with an attacker-controlled page while maintaining an active session or context with the vulnerable HCL AION deployment, enabling the unauthorized exfiltration of sensitive data payloads through cross-site scripting or script inclusion vectors.",
  "technicalDetails": "The root cause of the vulnerability stems from the improper handling and exposure of sensitive data within JavaScript responses generated by HCL AION. When endpoints return dynamic JavaScript containing confidential information without adequate safeguards against cross-origin script inclusion, external origins can instantiate or reference these scripts.\nThe attack flow initiates when an authenticated or targeted user visits an attacker-controlled web page containing malicious HTML or JavaScript code. The external page references the vulnerable HCL AION script endpoint directly, typically leveraging mechanisms such as script tags or overriding native JavaScript constructors (such as Array.prototype.push) to intercept and capture data structures as they are parsed and executed by the victim's browser.\nThe vulnerable component involves the server-side response generation logic within HCL AION, which fails to enforce strict Same-Origin Policy protections or utilize anti-cross-site inclusion prefixes (such as infinite loops or JSON protective prefixes) for sensitive data arrays or object literals. Network exposure encompasses web interfaces accessible to users whose browsers can be coerced into loading the external script resource.\nAuthentication and privilege requirements depend on the specific endpoint implementation, but exploitation frequently targets active user sessions to harvest session-specific or user-private data. The payload behavior executes within the context of the victim's browser session, extracting the sensitive properties or array contents populated by the HCL AION response and transmitting the harvested information back to the attacker's infrastructure via network requests."
}