CVE-2026-73220
Received Received - Intake

Stored XSS in CVAT Annotation Guide via Unsanitized Markdown

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73220
EUVD
EUVD-2026-63378

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cvat-ai cvat From 2.68.0 (inc) to 2.70.0 (inc)
cvat-ai cvat 2.70.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73220 is a stored cross-site scripting (XSS) vulnerability in CVAT (Computer Vision Annotation Tool) affecting versions 2.68.0 to 2.69.0. The issue occurs when an attacker with permission to create or edit an annotation guide injects malicious JavaScript code into the guide. When another user views the guide, the script executes in their browser, potentially allowing the attacker to perform actions on CVAT with the victim's privileges.

Detection Guidance

Check CVAT version with: curl -s http://<cvat-server>/api/server/about | grep version. If version is between 2.68.0 and 2.69.0, the system is vulnerable. Inspect network traffic for suspicious JavaScript execution in audio task annotation guides.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in the context of a user's browser session. This could lead to unauthorized actions such as modifying or deleting annotations, accessing sensitive data, or performing administrative tasks. Users with elevated privileges are at higher risk of significant impact.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to its impact on data confidentiality and integrity. The stored XSS flaw allows attackers to execute malicious scripts in users' browsers, potentially enabling unauthorized access to or theft of sensitive data processed by CVAT. This could lead to unauthorized data disclosure, modification, or loss, which are key concerns under GDPR and HIPAA.

Mitigation Strategies

Upgrade CVAT to version 2.70.0 or later immediately. If upgrading is not possible, disable audio task annotation guides or restrict guide creation/editing permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart