CVE-2026-65986: CVAT Annotation Tool XSS Vulnerability

CVE-2026-65986 Overview

CVE-2026-65986 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Computer Vision Annotation Tool (CVAT), an open source interactive video and image annotation platform. Versions 2.5.0 through 2.66.0 label annotation guide asset files with an attacker-influenced Content-Type media type. An authenticated attacker can upload a file whose content is served as HTML, causing the victim's browser to execute embedded JavaScript. The vulnerability is fixed in version 2.67.0.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in a victim's browser session, leading to account takeover, session theft, and unauthorized access to annotation project data.

Affected Products

CVAT versions 2.5.0 through 2.66.0
Self-hosted CVAT deployments serving annotation guide assets
CVAT instances allowing file uploads to annotation guides

Discovery Timeline

2026-08-04 - CVE-2026-65986 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-65986

Vulnerability Analysis

The vulnerability resides in CVAT's asset-serving logic for annotation guide attachments. When the application returns an uploaded file to a browser, it sets the Content-Type response header based on data the attacker controls during upload. A file containing HTML and JavaScript can be served with a media type of text/html, and the browser will render and execute its contents in the origin of the CVAT instance.

Because the payload executes in the same origin as the CVAT web application, the injected script inherits access to authenticated session cookies, CSRF tokens, and any API the logged-in victim can reach. Attackers can pivot to annotation project data, task metadata, or user administration endpoints depending on victim privileges. This flaw is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is the lack of a fixed, safe media type for annotation guide assets. The server relied on attacker-influenced metadata rather than a strict allowlist of MIME types, and it did not send response headers that would neutralize inline script execution. The fix imports the standard library mimetypes module in cvat/apps/engine/serializers.py and adds a strict Content-Security-Policy header to asset responses in cvat/apps/engine/views.py.

Attack Vector

An attacker with permission to create or edit an annotation guide uploads a crafted asset containing HTML and JavaScript. When another CVAT user, such as an administrator or project reviewer, opens the annotation guide and requests the asset URL, the browser interprets the response as HTML and executes the embedded script under the CVAT origin.

python

# Patch: cvat/apps/engine/views.py
def retrieve(self, request: ExtendedRequest, *args, **kwargs):
    instance = self.get_object()
    response = sendfile(
        request, os.path.join(settings.ASSETS_ROOT, str(instance.uuid), instance.filename)
    )
    # A backup measure in case a way is found to sneak malicious content
    # into one of the asset formats we allow.
    response["Content-Security-Policy"] = "default-src 'none'; sandbox"
    return response

Source: GitHub Commit 44d717a

Detection Methods for CVE-2026-65986

Indicators of Compromise

Annotation guide asset files with extensions or content patterns inconsistent with expected image formats (for example, .html, .svg containing <script>, or polyglot files).
HTTP responses from CVAT asset endpoints with Content-Type: text/html or other executable media types instead of image MIME types.
Outbound requests from user browsers to attacker-controlled domains shortly after loading a CVAT annotation guide.

Detection Strategies

Inspect CVAT web server access logs for asset retrievals under /api/assets/ returning non-image Content-Type headers.
Review annotation guide upload audit records for accounts that uploaded unusually large or non-standard files.
Deploy web proxy or DLP rules that flag HTML or JavaScript content served from CVAT asset routes.

Monitoring Recommendations

Track authenticated session activity for anomalous API calls occurring immediately after annotation guide asset requests.
Alert on CVAT admin actions initiated from user sessions that recently viewed uploaded assets.
Correlate CVAT application logs with browser-based telemetry to identify script execution originating from asset endpoints.

How to Mitigate CVE-2026-65986

Immediate Actions Required

Upgrade CVAT to version 2.67.0 or later, which enforces safe media types and applies a restrictive Content-Security-Policy on asset responses.
Audit all annotation guides created between versions 2.5.0 and 2.66.0 and remove or re-inspect any uploaded assets from untrusted contributors.
Rotate session tokens and API keys for accounts that may have viewed malicious assets while the flaw was exploitable.

Patch Information

The vulnerability is fixed in CVAT 2.67.0. The patch adds MIME-type handling in cvat/apps/engine/serializers.py and sets Content-Security-Policy: default-src 'none'; sandbox on asset retrieval responses in cvat/apps/engine/views.py. See the GitHub Security Advisory GHSA-w6mx-95ff-72cv and the remediation commit 44d717a for implementation details.

Workarounds

Restrict annotation guide creation and asset upload permissions to trusted administrators until the upgrade is applied.
Place CVAT behind a reverse proxy that rewrites asset responses to enforce safe Content-Type values and adds a strict Content Security Policy.
Serve CVAT asset content from a separate, sandboxed origin so that any XSS execution cannot access the main application session.

bash

# Reverse proxy example: force safe headers on CVAT asset responses (nginx)
location ~ ^/api/.*/assets/ {
    proxy_pass http://cvat_backend;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
}