CVE-2025-52635 is a low severity content security policy weakness (CVSS 3.7) in HCL AION 2.0. The record says Trusted Types in scripts are not enforced in the CSP. HCL publishes a security bulletin for AION. Read it for the fix, since the record lists no fixed version.
What's affected
The CVE record names HCL AION version 2.0 and describes the issue as Trusted Types in scripts not being enforced in the Content Security Policy. The weakness is listed as CWE-1032. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N: network reachable, but with high attack complexity, and a low impact on confidentiality only.
The record names no fixed version and gives no workaround. The reference is the HCL support bulletin KB0124444, titled as a security bulletin covering multiple vulnerabilities in HCL AION. That page is a script rendered support portal and its article text did not load when fetched, so check the bulletin for the fix and any extra steps. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild.
A low score does not mean there is nothing to do. This is a hardening gap, and it matters most where the application also has another way to inject script.
How to check if you're exposed
First confirm whether you run HCL AION 2.0. Check the product version in its administration or about screen, or in your deployment records.
Then look at the Content Security Policy that the application sends. Request any page and read the headers in your browser developer tools, or from a terminal:
curl -sI https://your-aion-host/ | grep -i content-security-policy
Look for require-trusted-types-for 'script' in the policy. If the directive is missing, the browser does not enforce Trusted Types for that page, which matches the weakness in the record. Follow the HCL bulletin for the supported fix, since a policy change made at a reverse proxy may not be what the vendor intends.
What to do now
- Confirm whether you run HCL AION 2.0 and where.
- Open HCL bulletin KB0124444 and follow its fix or upgrade guidance.
- Check the CSP header the application returns and note whether Trusted Types enforcement is present.
- Schedule the vendor fix in a normal maintenance window. The score is low, so there is no need for an emergency change.
- Review the application for any other script injection issues that this gap could make worse.
- Record the finding with its low severity and the planned date in your tracker.
Why it matters
Content Security Policy is a browser feature that limits where scripts can load from and what they can do. Trusted Types goes further: it makes the browser refuse to pass plain strings to dangerous page functions, so cross site scripting through the DOM becomes much harder. A policy that does not enforce it leaves one defense off.
On its own, that is not an attack. It is a missing safety net. The CVSS vector reflects this with high attack complexity and a low confidentiality impact. The risk grows only if some other flaw lets script be injected.
Treat it as a low priority item that should still be closed. Defense in depth is built from small items like this one, and the fix is usually a configuration or a vendor release rather than an incident.
Quick check
Is CVE-2025-52635 serious?
The record scores it 3.7, low severity. It is a hardening gap about Trusted Types in the CSP, so fix it in a normal maintenance cycle.
Where is the fix?
The record lists no fixed version. Check HCL bulletin KB0124444 for the supported fix.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52635
- HCL bulletin KB0124444, listed in the CVE record (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444). The article text did not load when fetched, so no fixed version is stated here.
Last reviewed: 18 October 2026.
