CVE-2025-36321 is an HTML injection vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability arises from improper neutralization of script-related HTML tags (CWE-80), enabling a remote attacker with limited privileges to inject malicious HTML code. When a victim views the injected content, the code executes within the security context of the hosting site, potentially leading to unauthorized actions or information disclosure. The CVSS 3.1 base score is 5.7, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality impact without integrity or availability impact. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to inject and execute malicious HTML code in the victim's browser under the security context of the IBM watsonx.data intelligence web application. This can lead to unauthorized disclosure of sensitive information accessible to the web application. The vulnerability does not impact integrity or availability according to the CVSS vector. The attack requires the attacker to have some privileges and user interaction to trigger execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit user privileges to reduce risk and avoid viewing untrusted content within the affected versions. Monitor IBM's security advisories for updates on patches or official mitigations.