Is there a patch available for CVE-2026-2472?

Yes, a patch is available for CVE-2026-2472. Update the affected software to the latest version immediately.

Google CVE-2026-2472

Q: What is the CVSS score of CVE-2026-2472?

CVE-2026-2472 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.2%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 f45cbf4e-4146-4068-b7e1-655ffc2c548c

GHSA-qv8j-hgpc-vrq8

Google XSS

8.6

CVSS 4.0 · Vendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

Severity by source

Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c).

CVSS VectorVendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 30, 2026 - 03:23 NVD

8.6 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 20:25 nvd

N/A

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on google-cloud-aiplatform (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.98.0.

DescriptionCVE.org

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.