Live › vulnerability › CVE-2026-117494
Go to dashboardStored/reflected XSS in Sisense Cloud BI Platform: SVG images sent to /api/v2/ai/sessions as data:image/svg+xml;base64 keep their script tags, and the script runs when the assistant window renders them. CVSS 4.0 8.3 (PR:L, UI:A): needs a logged-in user and a victim interaction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cloud BI Platform | vendor | all versions up to 2026-10-27 (SaaS, no version number published) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
This page as .md · .json · in your agent: get_signal("CVE-2026-117494")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.