CVE-2026-44369: CVAT: Stored XSS via annotation guides

Severity: high (CVSS 8.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-06-17
Weakness: CWE-80

Description

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.

Affected products

cvat-ai cvat: from 2.5.0, < 2.64.0

References

https://github.com/cvat-ai/cvat/commit/ad9e90003d8234ac7602598b109dc11450321dfc
https://github.com/cvat-ai/cvat/security/advisories/GHSA-m2h7-6xqm-p9v5

Get alerted when CVE-2026-44369 or the next vulnerability affects your stack