CVE-2025-31970 affects HCL DFXAnalytics (version 3.1 and below) due to an insecure Content-Security-Policy header configuration. The CSP lacks strict directives for object-src and base-uri, which are critical for restricting the sources of potentially dangerous content and preventing injection attacks. This misconfiguration can allow attackers to exploit injection vectors such as Cross-Site Scripting (XSS). The vulnerability is categorized under CWE-358, indicating an improperly implemented security check. The CVSS v3.1 base score is 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or patch has been published by HCL, and no known exploits have been reported.

The vulnerability could allow an attacker to exploit injection vectors like Cross-Site Scripting (XSS) due to insufficiently strict Content-Security-Policy directives. This may lead to limited confidentiality impact as indicated by the CVSS score, but no integrity or availability impacts are noted. Since no privileges or user interaction are required, exploitation could be relatively straightforward if an attacker can deliver malicious content. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing stricter Content-Security-Policy headers manually if possible, specifically defining restrictive object-src and base-uri directives to reduce the risk of injection attacks. Monitor HCL advisories for updates regarding patches or official mitigations.