CVE-2026-44369

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44369

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44369.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44369

Aliases

GHSA-m2h7-6xqm-p9v5

Published

2026-05-13T21:32:15.833Z

Modified

2026-07-15T01:49:04.169740613Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CVAT: Stored XSS via annotation guides

Details

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44369.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ]
}

References

Affected packages

Git / github.com/cvat-ai/cvat

Affected ranges

Type

GIT

Repo

https://github.com/cvat-ai/cvat

Events

Introduced

519c57f0c4267de6e4153c0fd1b6ebb7aae2a63d

Fixed

ad9e90003d8234ac7602598b109dc11450321dfc

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.64.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44369.json"