{"action":"Upgrade google-cloud-aiplatform to 1.131.0 or later.","affected":[{"fixed":"1.131.0","introduced":"1.98.0"}],"component":"google-cloud-aiplatform","cve_ids":["CVE-2026-2472"],"ecosystem":"PyPI","epss":0.00608,"exploited":false,"fixed_versions":["1.131.0"],"ghsa_id":"GHSA-qv8j-hgpc-vrq8","id":"tcs_01M5KGZV7QJ718TDHNPF97XEVB","modified_at":"2026-07-13T16:31:55.210915146Z","published_at":"2026-07-13T14:36:37.160051Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2499","https://nvd.nist.gov/vuln/detail/CVE-2026-2472","https://github.com/googleapis/python-aiplatform/commit/8a00d43dbd24e95dbab6ea32c63ce0a5a1849480","https://docs.cloud.google.com/support/bulletins#gcp-2026-011","https://github.com/JoshuaProvoste/CVE-2026-2472-Vertex-AI-SDK-Google-Cloud","https://github.com/googleapis/python-aiplatform","https://github.com/googleapis/python-aiplatform/releases/tag/v1.131.0","https://pypi.org/project/google-cloud-aiplatform","https://github.com/advisories/GHSA-qv8j-hgpc-vrq8"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2499","url":"https://osv.dev/vulnerability/PYSEC-2026-2499"},{"source":"nvd","source_id":"CVE-2026-2472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2472"}],"summary":"Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)"}