Cvat
Monthly
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.
Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access to an integrated cloud storage - or permission to add new cloud storage integrations - to overwrite arbitrary files on the server filesystem by embedding traversal sequences in cloud storage file paths processed by the application. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VI:H) confirms network-accessible, low-complexity exploitation requiring only low-privilege access with high integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authenticated user with annotation-guide create/edit privileges to inject malicious JavaScript into a task's annotation guide, which executes in any victim's browser that opens it. Executed script runs with the victim's CVAT session privileges, enabling arbitrary API requests on their behalf. No public exploit identified at time of analysis; EPSS is low (0.05%) and SSVC reports no observed exploitation.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 8.8 HIGH]
Broken object-level authorization in CVAT's lambda annotation API allows authenticated Worker-role users to exploit predictable task-based request IDs to read automatic annotation requests for tasks they are not permitted to access and to cancel annotation requests submitted by other users. All CVAT deployments running versions 2.17.0 through 2.71.x are affected per cpe:2.3:a:cvat-ai:cvat. No public exploit exists and this vulnerability is not listed in CISA KEV; SSVC assessment confirms no current exploitation, but multi-tenant environments with mixed-trust Worker accounts face meaningful workflow disruption risk.
Cross-organization report enumeration in CVAT before 2.69.0 exposes the existence of quality reports belonging to other organizations to any authenticated user. The vulnerability stems from a missing authorization gate in QualityReportViewSet.get_queryset, where the parent_id query parameter is processed without invoking check_object_permissions, allowing cross-tenant enumeration via differential HTTP response analysis. No public exploit or CISA KEV listing exists, but the attack is trivially automatable by any authenticated user in a multi-organization CVAT deployment.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a `user` role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
CVAT is an opensource interactive video and image annotation tool for computer vision. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.
Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access to an integrated cloud storage - or permission to add new cloud storage integrations - to overwrite arbitrary files on the server filesystem by embedding traversal sequences in cloud storage file paths processed by the application. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VI:H) confirms network-accessible, low-complexity exploitation requiring only low-privilege access with high integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authenticated user with annotation-guide create/edit privileges to inject malicious JavaScript into a task's annotation guide, which executes in any victim's browser that opens it. Executed script runs with the victim's CVAT session privileges, enabling arbitrary API requests on their behalf. No public exploit identified at time of analysis; EPSS is low (0.05%) and SSVC reports no observed exploitation.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 8.8 HIGH]
Broken object-level authorization in CVAT's lambda annotation API allows authenticated Worker-role users to exploit predictable task-based request IDs to read automatic annotation requests for tasks they are not permitted to access and to cancel annotation requests submitted by other users. All CVAT deployments running versions 2.17.0 through 2.71.x are affected per cpe:2.3:a:cvat-ai:cvat. No public exploit exists and this vulnerability is not listed in CISA KEV; SSVC assessment confirms no current exploitation, but multi-tenant environments with mixed-trust Worker accounts face meaningful workflow disruption risk.
Cross-organization report enumeration in CVAT before 2.69.0 exposes the existence of quality reports belonging to other organizations to any authenticated user. The vulnerability stems from a missing authorization gate in QualityReportViewSet.get_queryset, where the parent_id query parameter is processed without invoking check_object_permissions, allowing cross-tenant enumeration via differential HTTP response analysis. No public exploit or CISA KEV listing exists, but the attack is trivially automatable by any authenticated user in a multi-organization CVAT deployment.
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a `user` role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
CVAT is an opensource interactive video and image annotation tool for computer vision. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.