CVE-2026-23516: fallo de gravedad alta en cvat-ai cvat
CVAT vulnerable to XSS via skeleton SVG images
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.2%
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
cvat-ai · cvatCVEs relacionadas — cvat-ai cvat
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-31188HIGHServer-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)EPSS 48.2%CVE-2025-23045HIGHCVAT allows remote code execution via tracker Nuclio functionsEPSS 0.5%CVE-2026-73220HIGHCVAT: Stored XSS via annotation guides in audio tasksEPSS 0.5%CVE-2026-73219MEDIUMCVAT: Denial of service with regards to automatic annotationEPSS 0.5%CVE-2026-47682HIGHCVAT: Missing path-containment validation in multiple entry points allows arbitrary path writesEPSS 0.5%CVE-2026-73221MEDIUMCVAT: Flawed authorization logic in endpoints related to lambda requestsEPSS 0.4%