{"id":"CVE-2026-2472","state":"PUBLISHED","title":"Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization","description":"Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.","publishedAt":"2026-02-20T19:29:12.162Z","updatedAt":"2026-07-15T01:17:07.803Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber","source":"GoogleCloud"},"assigner":"GoogleCloud","products":["Google Cloud Vertex AI SDK for Python"],"affected":[{"vendor":"Google Cloud","product":"Vertex AI SDK for Python","defaultStatus":"unaffected","versions":[{"version":"1.98.0","status":"affected","lessThan":"1.131.0","versionType":"custom"}]}],"references":["https://docs.cloud.google.com/support/bulletins#gcp-2026-011","https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud","https://access.redhat.com/security/cve/CVE-2026-2472","https://bugzilla.redhat.com/show_bug.cgi?id=2441472","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2472.json","https://access.redhat.com/errata/RHSA-2026:10184"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2472.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2472","state":"PUBLISHED","datePublished":"2026-02-20T19:29:12.162Z","dateUpdated":"2026-07-15T01:17:07.803Z","assignerShortName":"GoogleCloud","assignerOrgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateReserved":"2026-02-13T15:38:12.195Z"},"containers":{"cna":{"title":"Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization","descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data."}],"affected":[{"vendor":"Google Cloud","product":"Vertex AI SDK for Python","defaultStatus":"unaffected","versions":[{"version":"1.98.0","status":"affected","lessThan":"1.131.0","versionType":"custom"}]}],"references":[{"url":"https://docs.cloud.google.com/support/bulletins#gcp-2026-011"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GoogleCloud","orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateUpdated":"2026-02-20T19:29:12.162Z"},"credits":[{"lang":"en","type":"reporter","value":"Din Asotić"}],"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Customers will need to update their google-cloud-aiplatform Python SDK to version 1.131.0 (released on 2025-12-16) or later to receive the fix.</p><p></p><br>"}],"value":"Customers will need to update their google-cloud-aiplatform Python SDK to version 1.131.0 (released on 2025-12-16) or later to receive the fix."}],"source":{"discovery":"EXTERNAL"},"tags":["exclusively-hosted-service"],"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-23T19:56:14.689621Z","id":"CVE-2026-2472","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-23T19:56:46.574Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-02-27T17:38:41.190Z"},"x_generator":{"engine":"ADPogram 0.0.1"}},{"title":"google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS)","descriptions":[{"lang":"en","value":"A flaw was found in google-cloud-aiplatform. This Stored Cross-Site Scripting (XSS) vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript code within a victim's Jupyter or Colab environment. This is achieved by injecting malicious script escape sequences into model evaluation results or dataset JSON data. The primary consequence is arbitrary code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-llama-stack-core-rhel9","defaultStatus":"affected","versions":[{"version":"1775144403","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2472","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441472","name":"RHBZ#2441472","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2472.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:17:07.803Z"},"datePublic":"2026-02-20T19:29:12.162Z","solutions":[{"lang":"en","value":"RHSA-2026:10184: Red Hat OpenShift AI 2.25"}],"timeline":[{"lang":"en","time":"2026-02-20T20:03:43.567Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-02-20T19:29:12.162Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}