---
id: "CVE-2026-117494"
kind: "vulnerability"
aliases: ["CVE-2026-117494"]
title: "AI sessions API: SVG uploads run injected script in the assistant window"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Cloud BI Platform", "fixed": [], "affected": "all versions up to 2026-10-27 (SaaS, no version number published)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-assistant", "ai-tooling", "auth-required", "cloud-bi", "saas", "sisense", "web-ui", "xss"]
not_affected_if: ["ai-assistant-disabled", "self-hosted-without-sisense"]
published_at: "2026-10-27T10:16:54+00:00"
first_seen_at: "2026-10-27T10:31:02+00:00"
updated_at: "2026-10-27T10:32:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117494", "first_seen_at": "2026-10-27T10:31:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T10:32:41+00:00"}]
---

# AI sessions API: SVG uploads run injected script in the assistant window

Stored/reflected XSS in Sisense Cloud BI Platform: SVG images sent to /api/v2/ai/sessions as data:image/svg+xml;base64 keep their script tags, and the script runs when the assistant window renders them. CVSS 4.0 8.3 (PR:L, UI:A): needs a logged-in user and a victim interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cloud BI Platform affected all versions up to 2026-10-27 (SaaS, no version number published) fixed ?

## How to check

Sisense Cloud is a SaaS service, so there is nothing to scan for on your side. Check whether your organization uses Sisense Cloud BI with the AI assistant enabled. Ask Sisense support for the remediation status of CVE-2026-117494. No version is published.

## Fix

unknown: INCIBE says no solution has been reported yet and the NVD record lists no fixed version. Sisense, as the SaaS operator, would have to patch. Watch the Sisense security page and the INCIBE notice.

## Timeline

- 2026-10-27T10:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117494
- 2026-10-27T10:32:41+00:00 analyst — Sisense Cloud BI Platform (SaaS), per INCIBE-CERT INCIBE-2026-794 (27/10/2026) and NVD record; no fix or vendor advisory published yet; not exploited per INCIBE; no PoC found. Vendor's own page not found, so nothing marked verified. Sibling CVE-2026-117493 (BloX widgets XSS) from same notice.

## Documents

- [advisory] INCIBE-CERT: Multiple vulnerabilities in Sisense's Cloud BI Platform (INCIBE-2026-794) https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform

## From the sources

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_