PyPI/google-cloud-aiplatform CVE-2026-2472: high 8.1, EPSS 0.61%

Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Action: Upgrade google-cloud-aiplatform to 1.131.0 or later.

pip install google-cloud-aiplatform==1.131.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2499
• nvd: CVE-2026-2472
• https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480
• https://docs.cloud.google.com/support/bulletins#gcp-2026-011
• https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud
• https://github.com/googleapis/python-aiplatform
• https://github.com/googleapis/python-aiplatform/releases/tag/v1.131.0
• https://pypi.org/project/google-cloud-aiplatform
• https://github.com/advisories/GHSA-qv8j-hgpc-vrq8

CVE-2026-2472 · published 2026-07-13T14:36:37.160051Z · modified 2026-07-13T16:31:55.210915146Z · JSON