Arbitrary JavaScript Execution Vulnerability in CVAT by CVAT-AI

CVE-2026-23516

What is CVE-2026-23516?

CVAT, an open-source interactive video and image annotation tool, is susceptible to arbitrary JavaScript execution due to vulnerabilities present in versions 2.2.0 to 2.54.0. An attacker can exploit this weakness by crafting malicious labels within CVAT tasks or projects. By enticing victims to either edit these labels or view associated shapes, or by having them upload specially crafted SVG images while configuring a skeleton, the attacker can gain temporary access to all resources that the victim user can access. The vulnerability has been addressed and resolved in version 2.55.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References