CVE-2026-21768

Deferred Deferred - Pending Action

Cross-Site Scripting in HCL Verse for Android

Publication date: 2026-06-19

Last updated on: 2026-06-22

Assigner: HCL Software

Description

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-22

Generated

2026-07-10

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-21768

EUVD

EUVD-2026-38035

Affected Vendors & Products

Vendor	Product	Version / Range
hcl	verse_for_android	1.0.0_rc14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the compose-rich-editor library (version 1.0.0-rc14) used by HCL Verse for Android for composing rich text emails. It fails to properly validate all HTML input, which allows malicious content to be executed in certain situations.

Impact Analysis

This vulnerability can lead to the execution of malicious content when composing emails, potentially allowing an attacker to compromise the confidentiality and integrity of your email communications. The CVSS score indicates a high impact on confidentiality and integrity, though availability is not affected.

Compliance Impact

The vulnerability in the compose-rich-editor library used in HCL Verse for Android allows malicious content to be executed due to improper validation of HTML input. This can lead to unauthorized disclosure or manipulation of sensitive information.

Such security weaknesses may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and integrity breaches.

However, specific details on compliance impact or mitigation measures related to these standards are not provided in the available resources.

Hi! I’m here to help you understand CVE-2026-21768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70