PT-2026-3868 · Intel · Cvat

Arkmarta · Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-23516

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CVAT versions 2.2.0 through 2.54.0

Description CVAT is an interactive video and image annotation tool for computer vision. An attacker can execute arbitrary JavaScript in a victim user's CVAT UI session. This is possible by creating a maliciously crafted label in a CVAT task or project, and then getting the victim user to either edit that label or view a shape referencing that label. Alternatively, the attacker can get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. Successful exploitation grants the attacker temporary access to all CVAT resources accessible to the victim user.

Recommendations Update to version 2.55.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-83

Related Identifiers

CVE-2026-23516

GHSA-3M7P-WX65-C7MP

Affected Products

Cvat

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23516.json · Exploit
• https://github.com/cvat-ai/cvat/commit/40800707fe39e3ff76c8d036eb953eb12d764e70 · Patch
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp · Patch
• https://osv.dev/vulnerability/CVE-2026-23516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23516 · Security Note
• https://twitter.com/CVEnew/status/2014095561272459438 · Twitter Post
• https://t.me/CVEtracker/42699 · Telegram Post