CVE-2026-65986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65986
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65986.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65986
Aliases
  • GHSA-w6mx-95ff-72cv
Published
2026-08-04T20:13:47.803Z
Modified
2026-08-12T03:51:14.344674247Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CVAT has stored XSS via annotation guide assets
Details

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.

Database specific 
{
    "cwe_ids": [
        "CWE-434",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65986.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cvat-ai/cvat

Affected ranges

Type
GIT
Repo
https://github.com/cvat-ai/cvat
Events
Introduced
519c57f0c4267de6e4153c0fd1b6ebb7aae2a63d
Fixed
e030d924fc00647b7d0e9376e3cccdaf52991b88
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.67.0"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.12.0
v2.12.1
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.15.0
v2.16.0
v2.16.1
v2.16.2
v2.16.3
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.20.0
v2.21.0
v2.21.1
v2.21.2
v2.21.3
v2.22.0
v2.23.0
v2.23.1
v2.24.0
v2.25.0
v2.26.0
v2.26.1
v2.27.0
v2.28.0
v2.29.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.40.0
v2.40.1
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.44.1
v2.44.3
v2.45.0
v2.46.0
v2.46.1
v2.47.0
v2.48.0
v2.48.1
v2.49.0
v2.5.0
v2.5.1
v2.5.2
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.56.0
v2.56.1
v2.57.0
v2.58.0
v2.59.0
v2.59.1
v2.6.0
v2.6.1
v2.6.2
v2.60.0
v2.61.0
v2.62.0
v2.63.0
v2.64.0
v2.65.0
v2.66.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.8.0
v2.8.1
v2.8.2
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65986.json"