Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI
    SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an
    unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment
    via injecting script escape sequences into model evaluation results or dataset JSON data. (CVE-2026-2472)

ID	Name	Product	Family	Type	Severity
462275	Echo: google-cloud-aiplatform: security update to 1.131.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
462275	Echo: google-cloud-aiplatform: security update to 1.131.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
437918	SCA: security update for google-cloud-aiplatform (GHSA-qv8j-hgpc-vrq8)	Tenable Cloud Security	SCA Checks	Local	high
437918	SCA: security update for google-cloud-aiplatform (GHSA-qv8j-hgpc-vrq8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-2472

high

Tenable Plugins

high

high

high

high