Publish Advisories

GHSA-qv8j-hgpc-vrq8
GHSA-wh2j-26j7-9728

Author: advisory-database[bot]

…-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.json …-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.jsonadvisories/unreviewed/2026/02/GHSA-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.json renamed to advisories/github-reviewed/2026/02/GHSA-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.json advisories/unreviewed/2026/02/GHSA-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.json renamed to advisories/github-reviewed/2026/02/GHSA-qv8j-hgpc-vrq8/GHSA-qv8j-hgpc-vrq8.json

@@ -1,36 +1,69 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qv8j-hgpc-vrq8",
-  "modified": "2026-02-20T21:31:24Z",
+  "modified": "2026-02-20T22:41:45Z",
   "published": "2026-02-20T21:31:24Z",
   "aliases": [
     "CVE-2026-2472"
   ],
+  "summary": "Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)",
   "details": "Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "google-cloud-aiplatform"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.98.0"
+            },
+            {
+              "fixed": "1.131.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2472"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480"
+    },
     {
       "type": "WEB",
       "url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-011"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/googleapis/python-aiplatform"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/googleapis/python-aiplatform/releases/tag/v1.131.0"
     }
   ],
   "database_specific": {
     "cwe_ids": [
       "CWE-79"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-20T22:41:44Z",
     "nvd_published_at": "2026-02-20T20:25:24Z"
   }
 }

…-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.json …-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.jsonadvisories/unreviewed/2026/02/GHSA-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.json renamed to advisories/github-reviewed/2026/02/GHSA-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.json advisories/unreviewed/2026/02/GHSA-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.json renamed to advisories/github-reviewed/2026/02/GHSA-wh2j-26j7-9728/GHSA-wh2j-26j7-9728.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wh2j-26j7-9728",
-  "modified": "2026-02-20T21:31:24Z",
+  "modified": "2026-02-20T22:41:41Z",
   "published": "2026-02-20T21:31:24Z",
   "aliases": [
     "CVE-2026-2473"
   ],
+  "summary": "Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming",
   "details": "Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).\n\nThis vulnerability was patched and no customer action is needed.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "google-cloud-aiplatform"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.21.0"
+            },
+            {
+              "fixed": "1.133.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -22,15 +43,23 @@
     {
       "type": "WEB",
       "url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-012"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/googleapis/python-aiplatform"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/googleapis/python-aiplatform/releases/tag/v1.133.0"
     }
   ],
   "database_specific": {
     "cwe_ids": [
       "CWE-340"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-20T22:41:41Z",
     "nvd_published_at": "2026-02-20T20:25:24Z"
   }
 }