Arbitrary JavaScript Execution Vulnerability in CVAT by CVAT-AI
CVE-2026-23516

8.6HIGH

Key Information:

Vendor

Cvat-ai

Status
Cvat
Vendor
CVE Published:
21 January 2026

What is CVE-2026-23516?

CVAT, an open-source interactive video and image annotation tool, is susceptible to arbitrary JavaScript execution due to vulnerabilities present in versions 2.2.0 to 2.54.0. An attacker can exploit this weakness by crafting malicious labels within CVAT tasks or projects. By enticing victims to either edit these labels or view associated shapes, or by having them upload specially crafted SVG images while configuring a skeleton, the attacker can gain temporary access to all resources that the victim user can access. The vulnerability has been addressed and resolved in version 2.55.0.

Affected Version(s)

cvat >= 2.2.0, < 2.55.0

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/40800707fe39e3ff76...
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.