{"id":"CVE-2026-117494","aliases":[],"title":"Multiple vulnerabilities in Sisense’s Cloud BI Platform","titleSource":"INCIBE","descriptionSource":"INCIBE","products":[{"vendor":"Sisense","name":"Cloud BI Platform","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27/10/2026","versionType":"custom"}],"defaultStatus":"unaffected","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-117494"}],"remediation":[{"text":"No solution has been reported as yet.","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-117494"}],"description":"Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.","severity":"high","score":8.3,"published":"2026-10-27T09:21:06.837Z","modified":"2026-10-27T09:21:06.837Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform"],"sources":[{"name":"CVE","id":"CVE-2026-117494","modified":"2026-10-27T09:21:06.837Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-117494"}],"assessments":[{"source":"INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L","score":8.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:35:32.302Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}