HCL DevOps Loop has a weakness where input validation is insufficient, allowing special characters to be entered in places where they should be prohibited. This can cause unintended application behavior under certain conditions. The flaw is a classic input validation weakness (CWE-754). While the reported impact is low, an attacker could potentially influence how data is processed, leading to erratic behavior or logic errors.

The affected product is HCL Software DevOps Loop. No specific version information is provided in the advisory, so all releases of DevOps Loop could be susceptible until an update is released by HCL.

The CVSS score of 3.1 indicates a low severity issue, and the EPSS score of less than 1% shows the likelihood of exploitation is very low. The vulnerability is not included in CISA’s KEV catalog. The most likely attack vector is an active user or script that supplies specially crafted input to the application, exploiting the lack of proper validation. Because the impact is limited to unintended behavior, the overall risk is modest, but vigilance is still warranted.