IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
Until an upgrade can be applied, IBM recommends the following precautions:
Only use IBM Bob Shell with trusted repositories and trusted code sources.
Avoid opening repositories obtained from unknown or untrusted parties.
Review repository contents and configuration before use in shared or public environments.
Follow organizational security practices for validating and approving source code repositories.
Note: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation.
IBM strongly recommends addressing the vulnerability now by upgrading to IBM Bob Shell V 2.0.2 or the later https://bob.ibm.com/docs/shell .
We recommend reviewing the documentation for guidance on installing IBM Bob https://bob.ibm.com/docs/ide/getting-started/install .