CVAT Stored Cross-Site Scripting Vulnerability in Annotation Guides

A stored cross-site scripting vulnerability has been identified in CVAT (Computer Vision Annotation Tool) versions 2.5.0 prior to 2.63.0. This issue allows an attacker with the ability to create or edit an annotation guide on a task to inject malicious JavaScript. The injected script executes in the browser of any user who opens the affected annotation guide, potentially making arbitrary requests to CVAT using the victim's privileges.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the annotation guide.

Remediation

Users are advised to upgrade to CVAT version 2.64.0, where this vulnerability has been patched.