cvat-ai — Vulnerabilities & Security Advisories 22

CVAT-AI is an open-source computer annotation tool primarily used for labeling visual data in machine learning pipelines. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting attacks, and privilege escalation flaws, with 15 CVEs documented to date. The platform's web interface and API have been frequent attack vectors due to insufficient input validation and authentication bypasses. While no major public security incidents have been reported, the consistent discovery of critical vulnerabilities suggests ongoing security challenges for organizations deploying this tool in production environments.