High severityNVD Advisory· Published Oct 27, 2026

CVE-2026-117494

Description

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sisense/Cloud BI Platformllm-create

Patches

Vulnerability mechanics

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platformnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000