CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/cvat-ai/cvat/commit/40800707fe39e3ff76c8d036eb953eb12d764e70 | Patch |
| https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp | Patch Third Party Advisory |
Configurations
History
20 Feb 2026, 20:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp - Patch, Third Party Advisory | |
| First Time |
Cvat computer Vision Annotation Tool
|
|
| CPE | cpe:2.3:a:cvat:computer_vision_annotation_tool:*:*:*:*:*:*:*:* |
02 Feb 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cvat
Cvat cvat |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://github.com/cvat-ai/cvat/commit/40800707fe39e3ff76c8d036eb953eb12d764e70 - Patch | |
| References | () https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp - Third Party Advisory, Patch | |
| CPE | cpe:2.3:a:cvat:cvat:*:*:*:*:*:*:*:* | |
| CWE | CWE-79 |
21 Jan 2026, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-21 22:15
Updated : 2026-02-20 20:08
NVD link : CVE-2026-23516
Mitre link : CVE-2026-23516
CVE.ORG link : CVE-2026-23516
JSON object : View
Products Affected
cvat
- computer_vision_annotation_tool