CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-p…
Info
Summary
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/cvat-ai/cvat/commit/33aaa1987ea89a4d229bf4c19fcbe6b04ed55b42
- https://github.com/cvat-ai/cvat/pull/10893
- https://github.com/cvat-ai/cvat/releases/tag/v2.70.0
- https://github.com/cvat-ai/cvat/security/advisories/GHSA-chxx-45vm-qhc9
Timeline
- nvd_ingest NVD