CVE-2026-2472

N/A

Description

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

CVE Details

CVSS v3.1 ScoreN/A

Published2/20/2026

Last Modified2/27/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-011(f45cbf4e-4146-4068-b7e1-655ffc2c548c)

https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.