p PatchFirst

PatchFirst · Latest vulnerabilities

google-cloud-aiplatform vulnerabilities

Vulnerabilities published for google-cloud-aiplatform in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-2473

    High · CVSS 7.7EPSS 0.51%Fix available

    Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.

    Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting). This vulnerability was patched and no customer action is needed.

    google-cloud-aiplatformPython
    • Update to 1.133.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-2472

    High · CVSS 8.6EPSS 0.61%Fix available

    Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

    Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment via injecting script escape sequences into model evaluation results or dataset JSON data.

    google-cloud-aiplatformPython
    • Update to 1.131.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →