Junglewise Threat Intelligence

CVE-2026-2472: Google Cloud Vertex AI SDK stored XSS in visualization component

CVE-2026-2472 · Severity: high · CVSS 8.1 · Published 2026-02-20

Vendors: Google, Red Hat, PyPI.

Executive brief

A security vulnerability exists in the Google Cloud Vertex AI SDK, a tool used by developers and data scientists to build and manage machine learning models. An attacker can inject malicious code into model evaluation results or datasets, which then executes when a user views these results in popular data science environments like Jupyter or Colab. This could allow an attacker to steal sensitive information, access cloud credentials, or perform unauthorized actions within the user's workspace.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the _genai/_evals_visualization component of the Google Cloud Vertex AI Python SDK. The root cause is the improper neutralization of attacker-controlled JSON data when embedding it into inline HTML <script> blocks within visualization functions like _get_evaluation_html and _get_inference_html. Specifically, the SDK fails to perform HTML script-context escaping, allowing an attacker to use script-closing sequences (e.g., </script>) to break out of the intended JavaScript data assignment. An unauthenticated remote attacker can exploit this by injecting malicious payloads into model evaluation results or dataset JSON files. When a victim renders these visualizations in a Jupyter or Colab notebook, the injected JavaScript executes in the context of the user's session. The issue is fixed in version 1.131.0.

Affected products

  • Google Cloud Vertex AI SDK for Python (google-cloud-aiplatform) 1.98.0 to 1.130.0
  • Red Hat Red Hat OpenShift AI 2.25

Timeline

  • 2025-12-16: patched: Version 1.131.0 released with fix
  • 2026-02-20: disclosed: Initial advisory published by Google Cloud
  • 2026-04-23: advisory: Red Hat published advisory RHSA-2026:10184

References

Related threats