CVE-2026-21833

Name of the Vulnerable Software and Affected Versions HCL AION (affected versions not specified)

Description The software does not configure the Content-Security-Policy (CSP) HTTP response header. CSP is a security layer that helps prevent Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header reduces the effectiveness of browser-based security controls, which may lead to unintended behavior or negative security impacts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.