The compose-rich-editor library used by HCL Verse for Android fails to properly validate all HTML input, creating an injection vulnerability (CWE-20) that can lead to the execution of malicious content (CWE-79). An attacker could craft a specially crafted email or message that, when rendered or edited, carries malicious code that is executed within the context of the application. This could potentially result in disclosure of sensitive data or unauthorized actions performed under the user's credentials.

HCLSoftware’s Verse for Android, version that includes compose‑rich‑editor v1.0.0‑rc14, is the only affected product. No other versions are listed as affected.

The CVSS score of 6.3 indicates a moderate severity risk. The EPSS score is currently unavailable, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted email or message that is opened or edited by a user within the application, so the threat requires user interaction or social engineering.