CVE-2025-36320 is a stored cross-site scripting vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), allowing an authenticated user to embed arbitrary JavaScript code in the web UI. This can alter the intended functionality of the application and potentially lead to the disclosure of credentials within a trusted session. The CVSS vector indicates the attack requires network access, low attack complexity, and privileges with no user interaction, with impact on confidentiality and integrity but no impact on availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An authenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the web application, potentially leading to unauthorized disclosure of credentials and alteration of application behavior within a trusted session. This compromises confidentiality and integrity of user data but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted authenticated users only and monitor for unusual activity related to web UI interactions. Avoid exposing the vulnerable versions in untrusted environments.