---
id: CVE-2026-117494
title: Multiple vulnerabilities in Sisense’s Cloud BI Platform
summary: >-
  Cross-Site Scripting (XSS) in the processing of SVG images submitted to the
  /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags
  embedded in the SVG are processed when the content is rendered in the
  assistant wind…
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-79
vendor: Sisense
product: Cloud BI Platform
affected:
  - cloud_bi_platform < 27/10/2026
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T09:21:06.837Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117494'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform
tags:
  - cve.org
epss: 0.0039
epssPercentile: 0.32914
ingestedAt: '2026-10-27T16:11:59.247Z'
---

## Overview

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.

## Affected

- `cloud_bi_platform < 27/10/2026`

## Remediation

No solution has been reported as yet.