IBM Bob versions 1.0.4 through 2.0.1 contain a vulnerability that allows remote attackers to inject arbitrary code due to improper control of user-supplied input. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.