SB2026072342 - Multiple vulnerabilities in IBM Db2 Mirror for i
Published: July 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-32635)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote user to execute arbitrary script in the context of the vulnerable application's domain.
The vulnerability exists due to cross-site scripting in Angular i18n attribute bindings when processing data bindings to untrusted user-generated data on security-sensitive attributes marked with i18n-. A remote user can supply a crafted bound value to execute arbitrary script in the context of the vulnerable application's domain.
User interaction is required, and the issue affects applications that bind unsanitized user input to a vulnerable attribute that is also marked for internationalization.
2) Cross-site scripting (CVE-ID: CVE-2026-27970)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the Angular internationalization (i18n) pipeline. A remote attacker can pass specially crafted ICU messages to the application and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Remediation
Install update from vendor's website.