CVE-2026-65986

Received Received - Intake

Cross-Site Scripting in CVAT Annotation Guide Assets

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-65986

EUVD

EUVD-2026-52895

Affected Vendors & Products

Vendor	Product	Version / Range
opencv	cvat	From 2.5.0 (inc) to 2.66.0 (inc)
opencv	cvat	2.67.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in CVAT versions 2.5.0 through 2.66.0. Attackers can upload files to an annotation guide and manipulate the Content-Type header to trick the victim's browser into executing JavaScript code embedded in the file. This occurs because CVAT incorrectly labels the file type, causing the browser to interpret it as HTML instead of plain data.

Detection Guidance

This vulnerability can be detected by checking CVAT versions. If your system runs versions 2.5.0 through 2.66.0, it is vulnerable. Use commands like 'pip show cvat' or check the version in the CVAT interface.

Impact Analysis

An attacker could exploit this to run malicious scripts in the context of a user's browser session. This may lead to unauthorized actions being performed on behalf of the user, theft of session cookies or sensitive data, or redirection to phishing sites. Users interacting with affected CVAT instances could have their accounts compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected CVAT versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade CVAT to version 2.67.0 or later immediately. Remove or restrict access to annotation guide assets until the upgrade is complete. Review uploaded files for suspicious content.

Hi! I’m here to help you understand CVE-2026-65986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70