---
id: CVE-2026-73220
title: >-
  CVAT is an open source interactive video and image annotation tool for
  computer vision
summary: >-
  CVAT is an open source interactive video and image annotation tool for
  computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide
  renderer in
  cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-righ…
severity: none
cwe:
  - CWE-80
published: '2026-08-20'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:44.913'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73220'
references:
  - url: >-
      https://github.com/cvat-ai/cvat/commit/33aaa1987ea89a4d229bf4c19fcbe6b04ed55b42
    label: security-advisories@github.com
  - url: 'https://github.com/cvat-ai/cvat/pull/10893'
    label: security-advisories@github.com
  - url: 'https://github.com/cvat-ai/cvat/releases/tag/v2.70.0'
    label: security-advisories@github.com
  - url: 'https://github.com/cvat-ai/cvat/security/advisories/GHSA-chxx-45vm-qhc9'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00483
epssPercentile: 0.39061
ingestedAt: '2026-09-16T13:56:12.594Z'
---

## Overview

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.