{"affected":[{"defaultStatus":"unaffected","product":"Cloud BI Platform","source":"CNA: INCIBE","vendor":"Sisense","versions":[{"lessThan":"27/10/2026","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-117494","cwes":["CWE-79"],"description":"Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.","epss":{"date":"2026-11-04","percentile":0.21018,"score":0.00284},"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L","version":"4.0"},{"score":8.3,"severity":"high","source":"NVD: cve-coordination@incibe.es","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793812650850,"publishedAt":1793092866837,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform"},{"source":"cve-coordination@incibe.es","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"No solution has been reported as yet."}],"revision":"3e7fb1583004c5b1182f3852b5093f85a5757c5fe2ef4050fdcfe0d188fa5c73","sources":[{"modifiedAt":1793810195150,"name":"CNA: INCIBE","retrievedAt":1793812162310,"url":"https://www.cve.org/CVERecord?id=CVE-2026-117494"},{"modifiedAt":1793812650850,"name":"NVD","retrievedAt":1793816488844,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117494"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793812192940,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-117494"}],"ssvc":{"assessedAt":1793810173052,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Multiple vulnerabilities in Sisense’s Cloud BI Platform","updatedAt":1793816488844}