IBM API Connect 12.1.0.0 through 12.1.1.2 can allow a remote authenticated attacker to inject and execute arbitrary scripts because user‑controlled input is not properly neutralized. The flaw enables the attacker to run code on the API gateway host, potentially compromising confidentiality, integrity, and availability of the gateway and any connected services.

The affected product is IBM API Connect. All instances built with version 12.1.0.0 up to and including 12.1.1.2 are vulnerable. Newer releases beyond 12.1.1.2 have been patched by IBM and are not impacted. The vulnerability is confined to the authenticated API management components, not public‑facing services without authentication.

The CVSS base score of 5.4 indicates a moderate severity risk. The EPSS score is not provided, so the probability of exploitation in the wild is uncertain, but the lack of a KEV listing suggests no publicly known exploitation yet. The flaw requires the attacker to possess valid authentication, so it is a privilege‑based attack vector that can be mitigated by restricting user privileges. No exploit code was reported at this time, but the ability to run arbitrary scripts represents a high leverage in the hands of an attacker.