CVE-2025-55254 HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)

What is CVE-2025-55254?

CVE-2025-55254 is a low-severity cross-site scripting vulnerability in HCL Software BigFix Remote Control, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

Weakness: CWE-613, CWE-601

Which versions are affected by CVE-2025-55254?

It affects 2 products.

Products include Hcltechsw Hcl Devops Deploy, Hcltechsw Hcl Launch.

How do I fix CVE-2025-55254?

No fix has been published for CVE-2025-55254 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-55254 being exploited?

There is no known exploitation of CVE-2025-55254 in the wild and no public exploit code.

Other vulnerabilities in HCL Software BigFix Remote Control

• CVE-2025-0255 HCL DevOps Deploy / HCL Launch is susceptible to command injection vulnerability High 7.2
• CVE-2026-56460 HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability Medium 6.5
• CVE-2025-0257 HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services Medium 6.3
• CVE-2024-23558 HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout Medium 6.3
• CVE-2026-56459 HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure Medium 6.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9287-x4fm-8g85.