HIGHCVSS 8.3

CVE-2026-117494

CVE-2026-117494 updated by NVD

Published: 2026-10-27
Modified: 2026-11-06
Sources: euvd, nvd

Summary

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-117494

Includes data from the ENISA EU Vulnerability Database (EUVD).

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.