Cvat-ai vulnerabilities
We track 9 vulnerabilities in Cvat-ai products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Cvat-ai vulnerabilities
- 8.5 High severity
cvat: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes atta
- 8.5 High severity
cvat: Improper Neutralization of Input During Web Page Generation
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide,
- 7.1 High severity
cvat: Improper Limitation of a Pathname to a Restricted Directory
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to ov
- 8.5 High severity
cvat: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser o
- 8.8 High severity
cvat: Privilege Defined With Unsafe Actions
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin g
- 9.8 Critical severity
cvat: Deserialization of Untrusted Data
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerabi
- 7.1 High severity
cvat: Cross-Site Request Forgery
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate
- 8.5 High severity
cvat: Server-Side Request Forgery
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to
- 9.8 Critical severity
cvat: Server-Side Request Forgery
CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in v