Cvat
CVE-2026-23516
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Attribute value escaping
|
| Impact | CVSS 5.4 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Computer Vision Annotation Tool. CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This
Know when Cvat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
Executive ViewAI
Organizations using versions 2.2.0 should be aware of moderate risk from CVE-2026-23516 rated CVSS 5.4. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
CVAT is an opensource interactive video and image annotation tool for computer vision. Rated critical severity (CVSS 9.8
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 8.8 HIGH]
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide ed
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authentica
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 ha
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Exploit-DB