Sisense Cloud BI Platform: Cross-site scripting via SVG in AI assistant
Summary
The SaaS Cloud BI Platform processes SVG images submitted to the /api/v2/ai/sessions API as data:image/svg+xml;base64. Script tags embedded in such an SVG are executed when the content is rendered in the AI assistant window. An attacker with a low-privileged account could lure a user into interacting, run JavaScript in the user's session and alter the displayed content. The CVSS 4.0 base score of 8.3 is the CNA's figure; the vendor has not published its own rating.
Affected
- Sisense Cloud BI Platform (SaaS), AI assistant feature
- Exact affected versions: Unknown. The CNA record lists the range as before 27/10/2026, which Sisense has not confirmed.
Fixed in
- Unknown. No patch or fixed version has been announced by Sisense.
Workaround
- No vendor workaround known.
- Restrict access to the AI assistant to trusted users.
- Treat SVG content entered via the assistant as untrusted.
Exploitation
- INCIBE lists the vulnerability as not exploited.
- No known in-the-wild exploitation, no public exploit code and no public proof of concept known at the time of writing.
Our recommendation
- Ask Sisense in writing whether your tenant is patched and when the fix will be deployed.
- Limit who can use the AI assistant until the fix is confirmed.
- Monitor dashboards and assistant sessions for unusual script or content changes.
- Assess CVE-2026-117493 (stored XSS in BloX widgets, same product and score) together with this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-794 www.incibe.es
- VulDB entry 427086 vuldb.com
- OffSeq threat radar CVE-2026-117494 radar.offseq.com
- Strix CVE-2026-117494 www.strix.ai
- ThreatInt CVE-2026-117494 cve.threatint.com
- TechTarget: Sisense AI features www.techtarget.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:12.
Original description (NVD)
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.