IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross‑site scripting flaw that allows an authenticated attacker to inject arbitrary JavaScript into HTML content supplied by a provider. The flaw arises because the API Connect platform does not adequately sanitize user‑supplied HTML before rendering it in a browser. As a result, a malicious script can run with the privilege of the victim’s browser session, enabling session‑hijacking, credential theft, or other client‑side attacks. This vulnerability is identified as CWE‑79.

The affected product is IBM API Connect. Vulnerable releases include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. All these releases run on the standard IBM API Connect installation and may host provider‑supplied HTML content.

The CVSS score of 8.7 indicates a high severity with an impact on confidentiality, integrity, and availability, but limited only to the client side through the victim’s browser. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, so exploitation probability cannot be precisely quantified. The attack vector is a remote authenticated attacker who can upload or modify provider‑supplied HTML content that is subsequently rendered in a user’s browser. The necessary condition for exploitation is that the victim’s browser loads the compromised content, making the vulnerability particularly dangerous for users with broad access to the API Connect console or front‑end interfaces.