CVE-2025-52643 Details
Description
HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact when processing specially crafted files.
A vulnerability exists in HCL AION version 2.0, where untrusted file parsing operations are not conducted within a properly isolated sandbox environment. This lack of isolation may expose the application to security risks, including unintended behavior or integrity issues when handling specially crafted files.
Users can upgrade to HCL AION version 2.1.2, which addresses this vulnerability. The HCL AION support team can assist with the upgrade process.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| hcltech aion | >= 2.0.0, < 2.1.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 25, 2026 | Reanalysis | [email protected] |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 16, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | New CVE Received | [email protected] |