CVE-2026-65986: cvat >= 2.5.0, < 2.67.0

Affected technology

cvat · >= 2.5.0, < 2.67.0
cvat-ai

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

The source says when CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality and integrity impact as high; availability impact as none.