CVE-2026-44369: CVAT: Stored XSS via annotation guides
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44369?
CVE-2026-44369 has a moderate severity as it allows stored cross-site scripting (XSS) when annotation guides can be manipulated.
How do I fix CVE-2026-44369?
To fix CVE-2026-44369, upgrade CVAT to a version later than 2.63.0 where the vulnerability is addressed.
Who is affected by CVE-2026-44369?
CVAT users running versions from 2.5.0 to 2.63.0 are affected by CVE-2026-44369.
What does CVE-2026-44369 exploit?
CVE-2026-44369 exploits the ability to create or edit annotation guides by injecting malicious JavaScript code.
What are the potential impacts of CVE-2026-44369?
The potential impacts of CVE-2026-44369 include unauthorized script execution in the user's browser, which can lead to data theft or session hijacking.