{
  "threat_severity" : "Important",
  "public_date" : "2026-02-20T19:29:12Z",
  "bugzilla" : {
    "description" : "google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS)",
    "id" : "2441472",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2441472"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.", "A flaw was found in google-cloud-aiplatform. This Stored Cross-Site Scripting (XSS) vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript code within a victim's Jupyter or Colab environment. This is achieved by injecting malicious script escape sequences into model evaluation results or dataset JSON data. The primary consequence is arbitrary code execution." ],
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift AI 2.25",
    "release_date" : "2026-04-23T00:00:00Z",
    "advisory" : "RHSA-2026:10184",
    "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9",
    "package" : "rhoai/odh-llama-stack-core-rhel9:sha256:50b543073492a4ffa9b71b8466e4b53cb6baec8d8d1bf72eed5a63bf82ca73bf"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-2472\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2472\nhttps://docs.cloud.google.com/support/bulletins#gcp-2026-011" ],
  "name" : "CVE-2026-2472",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}