PT-2026-125902

CVE-2026-117494

·

Published

2026-10-27

·

Updated

2026-10-27

Description by

CVSS 4.0
8.3
High
MetricsAV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-117494
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com