XSS in Cvat-ai Cvat
CVE-2026-65986
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Cvat-ai Cvat — versions >= 2.5.0, < 2.67.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)