SB20261112118 - Multiple vulnerabilities in IBM Watson Discovery

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261112118

SB20261112118 - Multiple vulnerabilities in IBM Watson Discovery

Published: November 12, 2026

Security Bulletin ID SB20261112118
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-65898)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass attribute sanitization restrictions.

The vulnerability exists due to improper access control in setConfig() when modifying sanitizer configuration. A remote user can invoke setConfig() to bypass attribute sanitization restrictions.


2) Protection Mechanism Failure (CVE-ID: CVE-2026-65899)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the context of a Trusted Types sink.

The vulnerability exists due to a protection mechanism failure in the Trusted Types policy handling in DOMPurify when reusing a DOMPurify instance across trust boundaries after calling clearConfig() and requesting RETURN_TRUSTED_TYPE. A remote user can influence a previously supplied trusted types policy on the reused instance to execute arbitrary script in the context of a Trusted Types sink.

Exploitation requires a shared DOMPurify instance, a previously retained unsafe or less-trusted policy, and a later sanitize call that requests RETURN_TRUSTED_TYPE.


3) Cross-site scripting (CVE-ID: CVE-2026-65900)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of script-related template expressions in template content in DOMPurify SAFE_FOR_TEMPLATES handling when sanitizing content using the RETURN_DOM or IN_PLACE output modes. A remote attacker can supply specially crafted template content with split expression text nodes to execute arbitrary script in the victim's browser.

The issue is specific to template content that is later normalized or evaluated by a template engine, allowing split text nodes to merge into a fully formed expression after sanitization.


Remediation

Install update from vendor's website.

References