Skip to content
fr Sign in
8.6 High

CVE-2026-2472 Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK…

Description

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI 2.25 1775144403 earliest → < 1775144403 1775144403
Vertex AI SDK for Python 1.98 1.98.0 → < 1.131.0 1.131.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI 2.25

The 140 CVEs of Red Hat OpenShift AI 2.25 →
CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI 6.5 Medium CVE-2026-18620 A flaw was found in Data Science Pipelines 7.1 High CVE-2026-18618 A flaw was found in ml-metadata 7.5 High CVE-2026-18611 A flaw was found in the Data Science Pipelines Operator 7.5 High
Track this CVE