SB20260216156 - Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
Published: February 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Exposed dangerous method or function (CVE-ID: CVE-2025-12735)
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to the application uses the unsafe evaluate() method on untrusted input. A remote attacker can pass specially crafted data to the application and execute arbitrary JavaScript code.
2) Protection Mechanism Failure (CVE-ID: CVE-2025-50181)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect implementation of the Redirect object when handling redirects and retries. A remote attacker can force the library to follow redirects even if explicitly disabled with PoolManager.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-66418)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to missing limits on the number of links in the decompression chain when handling gzip or zstd data in the server response. A malicious server can send a response with a large amount of links and cause high CPU load, leading to a denial of service condition.
4) Resource exhaustion (CVE-ID: CVE-2025-66471)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the streaming API does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Improper verification of cryptographic signature (CVE-ID: CVE-2025-65945)
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to improper signature verification under specific conditions when using the HS256 algorithm within the jws.createVerify() function. A remote attacker can manipulate header or payload in the HMAC secret lookup routines and bypass authorization checks.
6) Improper Handling of Windows Device Names (CVE-ID: CVE-2025-66221)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the "safe_join" function allows path segments with Windows device names. A remote attacker can cause reading of the file to hang indefinitely.
7) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2025-65106)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to template injection vulnerability in LangChain's prompt template system. A remote attacker can access Python object internals through template syntax.
Remediation
Install update from vendor's website.