CVE-2026-2472

N/A

Descricao

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado2/20/2026

Ultima modificacao2/27/2026

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-79

Referencias

https://docs.cloud.google.com/support/bulletins#gcp-2026-011(f45cbf4e-4146-4068-b7e1-655ffc2c548c)

https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.