8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2472

CVE-2026-2472: Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2472

CVE-2026-2472:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
google-cloud-aiplatform	pip	>= 1.98.0, < 1.131.0	1.131.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the _genai/_evals_visualization component of the Google Cloud Vertex AI SDK. The root cause is the unsafe embedding of model evaluation results or dataset JSON data directly into HTML templates that are rendered in Jupyter or Colab environments.

The analysis of the patch commit 8a00d43dbd24e95dbab6ea32c63ce0a5a1849480 reveals that three internal functions, _get_evaluation_html, _get_comparison_html, and _get_inference_html in the vertexai/_genai/_evals_visualization.py file were responsible for this vulnerability.

Before the patch, these functions used Python's f-strings to inject a JSON string directly into a <script> tag within the generated HTML. For example: <script>var vizData_vertex_eval_sdk = {eval_result_json};</script>. An attacker could craft a malicious payload within the eval_result_json or dataframe_json (e.g., by including script tags in the data) which would then be executed in the context of the victim's browser session.

The patch addresses this by Base64 encoding the JSON data on the server-side using a new _encode_to_base64 function and then decoding it on the client-side within the JavaScript using atob() and TextDecoder. This ensures that the data is treated as a string and not as executable code by the browser, effectively neutralizing the XSS vector.

The identified vulnerable functions are the ones that construct the HTML and were modified to include this encoding/decoding mechanism. During exploitation, a call to display an evaluation result, comparison, or inference data would lead to one of these functions being called, which would then render the malicious script.

Vulnerable functions

vertexai._genai._evals_visualization._get_evaluation_html

vertexai/_genai/_evals_visualization.py

The function directly injects the `eval_result_json` string into a JavaScript block within an HTML document. If this JSON string contains malicious script content, it will be executed by the browser, leading to a stored XSS vulnerability. The patch mitigates this by Base64 encoding the data, which is then decoded on the client side, preventing script execution.

vertexai._genai._evals_visualization._get_comparison_html

vertexai/_genai/_evals_visualization.py

vertexai._genai._evals_visualization._get_inference_html

vertexai/_genai/_evals_visualization.py

The function directly injects the `dataframe_json` string into a JavaScript block within an HTML document. If this JSON string contains malicious script content, it will be executed by the browser, leading to a stored XSS vulnerability. The patch mitigates this by Base64 encoding the data, which is then decoded on the client side, preventing script execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.