CVE-2026-15091

Analyzed Analyzed - Analysis Complete

IBM Engineering AI Hub Cross-Site Scripting Vulnerability

Publication date: 2026-07-17

Last updated on: 2026-07-24

Assigner: IBM Corporation

Description

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-24

Generated

2026-08-07

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-05

NVD

CVE-2026-15091

EUVD

EUVD-2026-45261

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	engineering_ai_hub	From 1.0.0 (inc) to 1.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to a cross-site scripting (XSS) attack. This occurs because the application fails to properly neutralize user input before rendering it in web pages, allowing attackers to inject malicious scripts.

Detection Guidance

Detection of this vulnerability requires checking for improper input neutralization in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. Inspect web application logs for unusual script execution or input handling anomalies. Review server configurations for exposed endpoints that may allow arbitrary script injection. Use vulnerability scanners to identify unpatched versions of the software.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary scripts in the context of a user's browser session. This may lead to theft of sensitive data, session hijacking, or unauthorized actions performed on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Immediately update IBM Engineering AI Hub to the latest patched version. If an update is unavailable, restrict network access to the application and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-15091. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70