CVE-2023-35899: IBM Cloud Pak for Automation CSV injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-21 · updated 2026-06-17
Weakness: CWE-1236

Description

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.

Affected products

IBM Cloud Pak for Business Automation: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3 (+33)

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/259354
https://www.ibm.com/support/pages/node/7030357
https://exchange.xforce.ibmcloud.com/vulnerabilities/259354
https://www.ibm.com/support/pages/node/7030357

Get alerted when CVE-2023-35899 or the next vulnerability affects your stack