PT-2026-21290 · Google · Google-Cloud-Aiplatform+1

Din Asotić · Published 2026-02-20 · Updated 2026-03-23 · CVE-2026-2472

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber

Name of the Vulnerable Software and Affected Versions Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions 1.98.0 through 1.130.9

Description A Stored Cross-Site Scripting (XSS) issue exists in the genai/ evals visualization component of Google Cloud Vertex AI SDK. This allows an unauthenticated remote attacker to execute arbitrary JavaScript within a victim's Jupyter or Colab environment. The attack is carried out by injecting script escape sequences into model evaluation results or dataset JSON data.

Recommendations Update to a version later than 1.130.9.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2472

GHSA-QV8J-HGPC-VRQ8

Affected Products

Google Cloud Vertex Ai Sdk

Google-Cloud-Aiplatform

References · 20

• 🔥 https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud · Exploit
• https://osv.dev/vulnerability/GHSA-qv8j-hgpc-vrq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2472 · Security Note
• https://github.com/googleapis/python-aiplatform/releases/tag/v1.131.0 · Note
• https://github.com/googleapis/python-aiplatform · Note
• https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480 · Note
• https://twitter.com/vuln_tracker/status/2027753640178381283 · Twitter Post
• https://t.me/CVEtracker/45309 · Telegram Post
• https://twitter.com/JoshuaProvoste/status/2027414776142283042 · Twitter Post
• https://docs.cloud.google.com/support/bulletins#gcp-2026-011 · Note
• https://reddit.com/r/VulnMatter/comments/1rdh91b/resumen_diario_de_vulnerabilidades_24022026 · Reddit Post
• https://t.me/proxy_bar/3168 · Telegram Post
• https://twitter.com/_cvereports/status/2024985080066650273 · Twitter Post
• https://t.me/poxek/5938 · Telegram Post
• https://twitter.com/akaclandestine/status/2027455965335789851 · Twitter Post