{"id":"CVE-2026-106020","aliases":["EUVD-2026-118264","GHSA-g936-836g-r2pg"],"status":"published","title":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO...","description":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.\n\nThis issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00127,"percentile":0.02384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1427"],"published":"2026-11-06T14:04:25Z","modified":"2026-11-06T15:31:27Z","products":[{"vendor":"johnson controls","product":"easyio neo io manager and tools installer"}],"references":[{"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106020"},{"url":"https://github.com/advisories/GHSA-g936-836g-r2pg"}],"sources":{"cve":[{"id":"CVE-2026-106020","description":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.\n\nThis issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.","status":"published","published":"2026-11-06T14:04:25.674Z","modified":"2026-11-10T04:54:25.467Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-1427"],"updated_at":"2026-11-10T05:37:08.449625Z"}],"euvd":[{"id":"EUVD-2026-118264","description":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.\n\nThis issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.","status":"published","published":"2026-11-06T14:04:25Z","modified":"2026-11-10T04:54:25Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-10T06:20:06.342465Z"}],"ghsa":[{"id":"GHSA-g936-836g-r2pg","title":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO...","description":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.\n\nThis issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.","status":"published","published":"2026-11-06T15:31:26Z","modified":"2026-11-06T15:31:27Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-106020","description":"Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.\n\nThis issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.","status":"published","published":"2026-11-06T15:17:05.847Z","modified":"2026-11-10T05:17:41.393Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"updated_at":"2026-11-07T00:02:36.552517Z"}]}}