JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud

PoC

Technical PoC for CVE-2026-2472 (GCP-2026-011): Unauthenticated and Stored Cross-Site Scripting (XSS) in google-cloud-aiplatform _genai/_evals_visualization (Vertex AI Python SDK) affecting Jupyter/Colab.

view exploit source poc_in_githubauthor JoshuaProvostepublished 2026-02-27catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-2472US	—	0.61% (49th)	Exploit	2026-02-20
Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan