EUVD-2026-30186Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain CVAT annotator account
-
DeliveryEdit task annotation guide with malicious Markdown/HTML
-
ExploitWait for privileged user to open guide
-
ExecutionInjected script executes in victim browser
-
PersistIssue CVAT API calls as victim
-
ImpactExfiltrate data or escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization HTML tag escaping
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a CVAT account with permission to create or edit a task's annotation guide (CVSS PR:L), and a victim user must open that annotation guide in the CVAT web UI for the payload to fire (CVSS UI:P). Exploitation is limited to CVAT versions 2.5.0 through 2.63.0 running the vulnerable cvat-ui Markdown preview; instances on 2.64.0+ are not exploitable. Impact is confidentiality/integrity of the victim's CVAT session only (VC:H/VI:H, VA:N, SC:N/SI:N) - no host or cross-origin compromise - so risk scales with how widely annotation-guide editing is delegated and how privileged typical guide-readers are. |
| Impact | Signals are mixed and lean toward a moderate, not critical, real-world priority. CVSS 4.0 base of 8.5 reflects network attack vector, low complexity, low privileges (PR:L - an authenticated annotator), and required user interaction (UI:P - a victim must open the guide), with high confidentiality and integrity impact but no availability or scope impact. EPSS is very low (0.05%, 14th percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - consistent with a stored XSS that requires an insider-style writer and a victim click, not a wormable internet-facing bug. The CVE is not on CISA KEV and no PoC is referenced. Net assessment: real risk in multi-tenant CVAT deployments where untrusted annotators can author guides and target admins/reviewers, but routine priority for single-tenant or trusted-team instances. |
| Exploit ScenarioDerived | An attacker with annotator or project-manager privileges edits a task's annotation guide and embeds malicious JavaScript (e.g., a script tag or event-handler attribute) inside its Markdown. When a reviewer or administrator subsequently opens that guide in the CVAT UI, the script executes under their session and silently issues CVAT API calls - exfiltrating annotations, modifying project membership, or escalating the attacker's role. No public PoC is referenced, but the bug pattern (unsanitized Markdown preview) is trivial for an attacker familiar with stored XSS to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authenticated user with annotation-guide create/edit privileges to inject malicious JavaScript into a task's annotation guide, which executes in any victim's browser that opens it. Executed script runs with the victim's CVAT session privileges, enabling arbitrary API requests on their behalf. No public exploit identified at time of analysis; EPSS is low (0.05%) and SSVC reports no observed exploitation.
RemediationAI
Vendor-released patch: upgrade CVAT to 2.64.0 or later, which adds the rehype-sanitize rehype plugin to the Markdown preview pipeline in annotation-guide-page.tsx and top-bar/right-group.tsx (fix commit ad9e90003d8234ac7602598b109dc11450321dfc, advisory https://github.com/cvat-ai/cvat/security/advisories/GHSA-m2h7-6xqm-p9v5). If immediate upgrade is not possible, restrict annotation-guide create/edit permissions to a small set of trusted users (project owners/maintainers) to remove the injection foothold - note this blocks legitimate annotator contributions to guides. As an additional compensating control, deploy a strict Content Security Policy on the CVAT frontend that forbids inline scripts and restricts script-src to the CVAT origin, which mitigates execution of injected payloads at the cost of breaking any legitimate inline-script customizations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVAT is an open-source web-based image and video annotation platform widely used for building computer-vision training datasets. The flaw is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS) and lives in the Markdown-based annotation guide editor and previewer in the cvat-ui React frontend. Per CPE cpe:2.3:a:cvat-ai:cvat, the cvat-ui Markdown preview component (annotation-guide-page.tsx and top-bar/right-group.tsx) rendered user-supplied Markdown without HTML sanitization, allowing raw HTML/JS in the rendered output. The vendor fix introduces the rehype-sanitize rehype plugin into the Markdown preview pipeline (previewOptions.rehypePlugins), filtering dangerous tags/attributes from the HAST tree before rendering.
Know when Cvat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.
Executive ViewAI
CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 contain a stored cross-site scripting vulnerability that allows authenticated users with annotation-guide privileges to execute arbitrary JavaScript in other users' browsers with their session privileges. No public exploit identified at time of analysis; however, any privileged user with malicious intent could manipulate annotation guides to compromise other users' sessions and authorize unauthorized API actions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
CVAT is an opensource interactive video and image annotation tool for computer vision. Rated critical severity (CVSS 9.8
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 8.8 HIGH]
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide ed
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 ha
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
Exploit-DB