CVE-2026-44369
Last modified
CVE-2026-44369 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser of anyone who opens this annotation guide. This code will be able to make arbitrary requests to CVAT with the victim user's privileges. This vulnerability is fixed in 2.64.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-44369?
How severe is CVE-2026-44369?
How do I fix CVE-2026-44369?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44363MISP modules are autonomous modules that can be used to exte…5.8
- CVE-2026-44364MISP modules are autonomous modules that can be used to exte…9.3
- CVE-2026-44365Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-44366Vvveb is a powerful and easy to use CMS with page builder to…6.1
- CVE-2026-44367Klaw is a self-service Apache Kafka Topic Management/Governa…2.7
- CVE-2026-44368PyQuorum is a cryptographic library for secret sharing and k…6.9
- CVE-2026-4437Calling gethostbyaddr or gethostbyaddr_r with a configured n…7.5
- CVE-2026-44371Open OnDemand is an open-source high-performance computing p…5.3
- CVE-2026-44372Nitro is a next generation server toolkit. Prior to 3.0.2604…6.1
- CVE-2026-44373Nitro is a next generation server toolkit. Prior to 3.0.2604…5.3
- CVE-2026-44374Backstage is an open framework for building developer portal…4.3
- CVE-2026-44375Nerdbank.MessagePack is a NativeAOT-compatible MessagePack s…7.5
Are you affected by CVE-2026-44369?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST