CVE-2026-15091
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 contain a cross-site scripting vulnerability that allows a remote attacker to inject and execute arbitrary scripts in a user's browser. The issue arises from improper neutralization of input during web page generation. No known exploitation or public exploit is currently reported.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0
Real-world impact
An attacker could run malicious scripts in the context of a victim's browser, potentially stealing data or performing actions on behalf of the user.
Why this severity
CVSS v3.1 base score 9.3 (Critical) due to network‑adjacent attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality and integrity impacts.
What to do about it
- 01No official fix is mentioned in the provided sources; monitor the vendor’s security advisories for future patches.
- ›Apply input validation and output encoding to neutralize user‑supplied data before it is included in web pages.
- ›Consider using Content Security Policy (CSP) headers to reduce the impact of successful XSS attempts.
Remediation guidance is based on general best practices for CWE‑79; no vendor‑specific patch is referenced in the supplied data.
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- ibm.com/support/pages/node/7279964vendor advisory