The vulnerability lies in HCL AION’s omission of the Content‑Security‑Policy response header. Without this header, a browser cannot limit script or content sources, thereby giving attackers a feasible route to inject malicious scripts or other content that can lead to cross‑site scripting or other content‑injection attacks. The described impact would be unintended behavior or potential security breaches depending on the attacker’s access and the application’s context.

The affected vendor is HCL Software with the HCL AION application. No specific version range is provided in the CNA data, so all deployments of HCL AION are potentially impacted until a remedy is applied.

The CVSS score of 3.1 indicates low overall severity, and the EPSS score is not available, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The primary attack vector is inferred to be a browser‑based exploitation where a malicious web page or compromised resource can deliver injected scripts to a victim who visits the HCL AION application. The lack of a CSP header removes a critical browser‑side protective measure, but an attacker still needs a method to deliver the content, such as phishing or compromise of trusted sites.