What is GHSA-g936-836g-r2pg?

GHSA-g936-836g-r2pg is a security advisory published by GitHub Security Advisories with High severity. Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO...

Which CVE IDs does GHSA-g936-836g-r2pg cover?

GHSA-g936-836g-r2pg covers the following CVE IDs: CVE-2026-106020. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-g936-836g-r2pgHigh

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-106020 →

📋 Description

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking.

This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-106020
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://github.com/advisories/GHSA-g936-836g-r2pg