CVE-2026-121145
Received Received - Intake

Cross-Site Scripting in iRA 2.0 and iRA.ev Mobile Apps

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121145
EUVD
EUVD-2026-116905

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Tata Motors Tata Motors iRA 2.0 versions 26.7.3 and below
Tata Motors Tata Motors iRA.ev versions 26.7.2 and below

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this by sending malicious web content to the affected WebView.

Detection Guidance

Detecting this vulnerability requires checking for insecure WebView implementations in the iRA 2.0 and iRA.ev mobile applications. Inspect the app's network traffic for unauthorized interactions or token exposure. Use static analysis tools to review WebView URL validation logic.

Impact Analysis

Successful exploitation could allow an attacker to perform unauthorized actions, obtain live bearer authentication tokens, impersonate the user, and access vehicle-related information and services.

Compliance Impact

The vulnerability could lead to unauthorized access to user data, including vehicle-related information and authentication tokens, which may violate data protection requirements under GDPR and HIPAA if such data is considered personal or sensitive health information.

Mitigation Strategies

Update the iRA 2.0 and iRA.ev mobile applications to the latest version to ensure URL and origin validation is properly enforced in the WebView component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...