IBM Cognos Analytics versions 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 contain a cross-site scripting (XSS) vulnerability. This flaw arises from improper validation of column headings in the Cognos Assistant component, which could allow a remote attacker with limited privileges to execute malicious commands. The vulnerability has a medium severity rating with a CVSS score of 5.4.