The vulnerability in Tanium’s Comply product is an improper output sanitization flaw. This weakness allows attackers to embed malicious content into outputs that are not properly escaped, which could enable execution of unintended code or unauthorized data access. The issue aligns with CWE‑1236, highlighting unsafe handling of output data.

Tanium Comply is the affected product. No specific version information is listed, so any deployment of the product before the patch that addressed the flaw is vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available, so the likelihood of exploitation at this time is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to craft or influence the content returned by Comply and exploit the lack of proper output sanitization. No official workaround is provided by Tanium.