CVE-2025-36320 is a stored cross-site scripting vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), enabling an authenticated user to embed malicious JavaScript code in the web UI. This can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability. No official patch or remediation level has been published by IBM as of the data provided.

An authenticated attacker can exploit this vulnerability to inject arbitrary JavaScript into the web interface, which may lead to unauthorized disclosure of sensitive information such as credentials within the context of a trusted session. This compromises confidentiality and integrity of the affected system's web UI functionality. There is no indication of impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor IBM's advisories for updates. Until a patch is available, limit access to trusted users only and consider applying web application firewall rules to detect and block suspicious input patterns related to XSS. Avoid exposing the affected versions publicly where possible.