CVE-2025-36321 is an HTML injection vulnerability in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The issue arises from improper neutralization of script-related HTML tags (CWE-80), enabling a remote attacker with limited privileges to inject malicious HTML code. When a victim views the injected content, the malicious code executes in their browser under the security context of the affected site, potentially leading to partial confidentiality impact. The vulnerability requires user interaction (UI:R) and has no known exploits in the wild. No official patch or remediation guidance has been provided by the vendor as of the published date.

A remote attacker with limited privileges can inject malicious HTML code that executes in the victim's browser when viewed. This can lead to confidentiality impact by exposing sensitive information accessible in the browser context. There is no reported impact on integrity or availability. The vulnerability requires user interaction to trigger the malicious code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by IBM, users should monitor IBM's advisories for updates. Until a fix is available, consider restricting user input that can be rendered as HTML or applying web application firewall rules to detect and block suspicious HTML injection attempts.