CVE-2026-23516

The record

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-45118 MyBB is free and open source forum software. CWE-83
• CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. CWE-83
• CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. CWE-83
• CVE-2026-49276 Kirby is an open-source content management system. CWE-83
• CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave… CWE-83
• GHSA-6xcg-6q43-rj2v Duplicate Advisory: Exported session HTML could keep unsafe markdown links CWE-83
• CVE-2026-53841 OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported… CWE-83
• GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL CWE-83