CVE-2026-21832 describes a vulnerability in HCL Software's AION product (version 2.5.0) where improper neutralization of input used for large language model (LLM) prompting (CWE-1427) allows indirect prompt injection. This injection can lead to HTML injection in the rendered output, causing injected markup to be displayed to users. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring low privileges without user interaction. No known exploits are reported in the wild, and no vendor-provided patch or remediation details are currently available.

The vulnerability may allow an attacker with low privileges to inject HTML markup into the rendered output via indirect prompt injection. This could result in unintended behavior or security impact under certain conditions, such as UI manipulation or content spoofing. Confidentiality impact is low, with no integrity or availability impacts reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input sources that influence LLM prompting and consider restricting or sanitizing inputs where possible.