Which versions of Vertex AI SDK are affected by CVE-2026-2472?

Google Cloud Vertex AI SDK for Python (versions 1.98.0-1.130.x) contains a stored cross-site scripting vulnerability in model evaluation visualization that allows attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-2472?

Within 24 hours: Identify all systems running google-cloud-aiplatform versions 1.98.0 through 1.130.x and notify affected data science teams of the vulnerability and patching requirement. Within 7 days: Update all affected installations to version 1.131.0 or later and restart all Jupyter and Colab kernels using the updated library. Within 30 days: Audit evaluation datasets and model outputs from the vulnerable period for evidence of script injection, and implement input validation controls to restrict model evaluation data sources to trusted internal origins only.

Vertex AI SDK CVE-2026-2472

Q: What is the CVSS score of CVE-2026-2472?

CVE-2026-2472 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.2%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 f45cbf4e-4146-4068-b7e1-655ffc2c548c

GHSA-qv8j-hgpc-vrq8

XSS Google

8.6

CVSS 4.0 · Vendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

Severity by source

Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

vuln.today AI

8.7 HIGH

PR:L and UI:R because the attacker must inject pipeline data and the victim must render it; S:C and C:H/I:H reflect JS executing in the victim's notebook context beyond the SDK component.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c).

CVSS VectorVendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 03:23 NVD

8.6 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 20:25 cve.org

HIGH 8.6

CVE Published

Feb 20, 2026 - 20:25 nvd

N/A

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on google-cloud-aiplatform (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.98.0.

DescriptionCVE.org

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

AnalysisAI

Stored cross-site scripting in Google Cloud's Vertex AI SDK for Python (google-cloud-aiplatform) lets an attacker execute arbitrary JavaScript inside a victim's Jupyter or Colab session by planting script escape sequences in model evaluation results or dataset JSON that the SDK's _genai/_evals_visualization component renders unsanitized. Affected versions run from 1.98.0 up to (but not including) 1.131.0, and any data scientist who visualizes attacker-influenced evaluation output is at risk. A GitHub proof-of-concept repository is referenced, so publicly available exploit code exists; the flaw is not in CISA KEV, and EPSS is low at 0.19% (41st percentile).

Technical ContextAI

The vulnerability is a CWE-79 stored/persistent XSS, but the sink is unusual: instead of a web app, the untrusted data is rendered inside interactive notebook environments (Jupyter/Colab) by the Vertex AI SDK's generative-AI evaluation visualization helper (_genai/_evals_visualization). This helper builds HTML/JS to display model evaluation metrics and dataset rows; because it fails to neutralize script escape sequences embedded in evaluation results or dataset JSON, injected markup executes in the notebook's frontend context when the visualization cell renders. The affected component is part of google-cloud-aiplatform, the official Python SDK used to interact with Google Cloud Vertex AI (model training, tuning, and GenAI evaluation). No CPE strings were provided in the input, so exact affected configuration URIs could not be enumerated beyond the vendor-stated version range.

Affected ProductsAI

Google Cloud Vertex AI SDK for Python, package google-cloud-aiplatform, all releases from version 1.98.0 up to but not including 1.131.0 (1.131.0 contains the fix). The vulnerable code path is the _genai/_evals_visualization component used to render model evaluation results in Jupyter/Colab. Red Hat ships affected builds and tracks the issue via RHSA-2026:10184 and its CVE page (https://access.redhat.com/security/cve/CVE-2026-2472). Google's advisory is published in the Google Cloud security bulletins (https://docs.cloud.google.com/support/bulletins#gcp-2026-011). No CPE strings were supplied in the source data, so affected platform URIs could not be independently confirmed.

RemediationAI

Vendor-released patch: upgrade google-cloud-aiplatform to 1.131.0 or later, which remediates the _evals_visualization sanitization gap; this is the primary and recommended fix (pip install --upgrade 'google-cloud-aiplatform>=1.131.0'). Red Hat users should apply errata RHSA-2026:10184 (https://access.redhat.com/errata/RHSA-2026:10184, https://access.redhat.com/security/cve/CVE-2026-2472) and consult Google's bulletin at https://docs.cloud.google.com/support/bulletins#gcp-2026-011. Until patched, avoid rendering the evaluation visualization on evaluation results or dataset JSON that originated from untrusted or externally supplied sources, and open such notebooks only in disposable/sandboxed Colab or Jupyter kernels that hold no cloud credentials or long-lived tokens - the trade-off is reduced convenience and loss of the interactive visualization feature for those datasets. Restricting who can supply evaluation datasets into shared pipelines further limits the injection surface but does not fully eliminate risk from partner-supplied data.