CVE-2026-65986

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/cvat-ai/cvat/commit/44d717ad3a9d914f1cb2593ce09efd87d0b9159e
https://github.com/cvat-ai/cvat/security/advisories/GHSA-w6mx-95ff-72cv

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) CVAT es una herramienta de anotación interactiva de video e imagen de código abierto para visión por computadora. Las versiones 2.5.0 a 2.66.0 contienen una vulnerabilidad XSS a la que se puede acceder a través de los activos de la guía de anotación. Cuando CVAT sirve los archivos adjuntos a una guía de anotación, los etiqueta con un tipo de medio ( Content-Type ) que el atacante puede influir, de modo que en lugar de tratar un archivo subido como datos planos, se le puede indicar al navegador de la víctima que lo trate como una página HTML y ejecute cualquier JavaScript dentro de ella. Este problema ha sido solucionado en la versión 2.67.0.

Information

Published : 2026-08-04 21:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-65986

Mitre link : CVE-2026-65986

CVE.ORG link : CVE-2026-65986

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-65986", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65986", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T18:53:16.359344Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cvat-ai", "product": "cvat", "versions": [{"status": "affected", "version": ">= 2.5.0, < 2.67.0"}]}]}], "published": "2026-08-04T21:16:36.990", "references": [{"url": "https://github.com/cvat-ai/cvat/commit/44d717ad3a9d914f1cb2593ce09efd87d0b9159e", "source": "security-advisories@github.com"}, {"url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-w6mx-95ff-72cv", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type (\u00a0Content-Type\u00a0) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0."}, {"lang": "es", "value": "CVAT es una herramienta de anotaci\u00f3n interactiva de video e imagen de c\u00f3digo abierto para visi\u00f3n por computadora. Las versiones 2.5.0 a 2.66.0 contienen una vulnerabilidad XSS a la que se puede acceder a trav\u00e9s de los activos de la gu\u00eda de anotaci\u00f3n. Cuando CVAT sirve los archivos adjuntos a una gu\u00eda de anotaci\u00f3n, los etiqueta con un tipo de medio ( Content-Type ) que el atacante puede influir, de modo que en lugar de tratar un archivo subido como datos planos, se le puede indicar al navegador de la v\u00edctima que lo trate como una p\u00e1gina HTML y ejecute cualquier JavaScript dentro de ella. Este problema ha sido solucionado en la versi\u00f3n 2.67.0."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}