The flaw allows attackers to insert malicious payloads into CSV files exported from HCL iControl due to insufficient sanitation of user input. When a victim opens the generated CSV in a spreadsheet or web application that interprets the content without proper escaping, the injected script can run in the victim’s browser, potentially stealing session cookies, injecting malicious data, or defacing the application. The vulnerability is a classic example of reflected XSS manifested through CSV output.

HCL iControl is impacted. The data set does not specify a vulnerable version, so any installation applying the affected code path should be reviewed and updated.

The CVSS score of 7.1 indicates a high severity flaw, although the EPSS score is unavailable, making the probability of exploitation uncertain. It is not tracked in the CISA KEV catalog. Attackers could exploit the flaw by crafting a CSV export request that includes malicious content. The vulnerability is accessed through normal user interaction with the export functionality; it requires that a victim open the resulting CSV file in a client that will process the injected content.