CVE-2025-31970 affects HCL DFXAnalytics (version 3.1 and below) due to an insecure Content-Security-Policy header configuration. The lack of strict directives for object-src and base-uri in the policy may enable attackers to exploit injection vectors like Cross-Site Scripting (XSS). This vulnerability is categorized under CWE-358, which involves improperly implemented security checks. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor-provided patch or remediation level is currently documented.

The vulnerability could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS) due to insufficient Content-Security-Policy restrictions. This may lead to limited confidentiality impact but does not affect integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider reviewing and tightening Content-Security-Policy headers manually to include strict object-src and base-uri directives to mitigate potential injection attacks.