PT-2026-3868 · Intel · Cvat

Arkmarta · Publicado 2026-01-21 · Atualizado 2026-01-21 · CVE-2026-23516

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CVAT versions 2.2.0 through 2.54.0

Description CVAT is an interactive video and image annotation tool for computer vision. An attacker can execute arbitrary JavaScript in a victim user's CVAT UI session. This is possible by creating a maliciously crafted label in a CVAT task or project, and then getting the victim user to either edit that label or view a shape referencing that label. Alternatively, the attacker can get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. Successful exploitation grants the attacker temporary access to all CVAT resources accessible to the victim user.

Recommendations Update to version 2.55.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

CWE-83

Identificadores relacionados

CVE-2026-23516

GHSA-3M7P-WX65-C7MP

Produtos afetados

Cvat

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23516.json · Exploit
• https://github.com/cvat-ai/cvat/commit/40800707fe39e3ff76c8d036eb953eb12d764e70 · Correção
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp · Correção
• https://osv.dev/vulnerability/CVE-2026-23516 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23516 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014095561272459438 · Publicação no Twitter
• https://t.me/CVEtracker/42699 · Publicação no Telegram