---
id: CVE-2026-2472
aliases:
  - GHSA-qv8j-hgpc-vrq8
  - PYSEC-2026-2499
title: Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
summary: Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
severity: high
vendor: google-cloud-aiplatform
product: google-cloud-aiplatform
ecosystem: pip
affected:
  - 'google-cloud-aiplatform >= 1.98.0, < 1.131.0'
patched:
  - google-cloud-aiplatform 1.131.0
published: '2026-02-20'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qv8j-hgpc-vrq8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2472'
  - url: >-
      https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480
  - url: 'https://docs.cloud.google.com/support/bulletins#gcp-2026-011'
  - url: 'https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud'
  - url: 'https://github.com/googleapis/python-aiplatform'
  - url: 'https://github.com/googleapis/python-aiplatform/releases/tag/v1.131.0'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00542
epssPercentile: 0.4451
ingestedAt: '2026-07-13T18:58:02.264Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud'
    - 'https://github.com/megafart1/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud'
  checkedAt: '2026-09-24T07:53:01.087Z'
exploitAvailable: true
---

## Overview

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

## Affected packages

- `google-cloud-aiplatform >= 1.98.0, < 1.131.0`

## Remediation

Upgrade to a patched release:

- `google-cloud-aiplatform 1.131.0`