{"data":{"id":"72308cd3-7334-4918-b796-5129f8055a75","title":"CVE-2024-12236: A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for…","summary":"CVE-2024-12236 affects the Vertex Gemini API for customers using VPC-SC. A custom crafted file URI supplied as image input routes requests outside the VPC-SC security perimeter, which allows data exfiltration and circumvents the intended VPC-SC restrictions.","solution":"Google Cloud Platform implemented a fix that returns an error when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12236","publishedAt":"2024-12-10T15:15:07.147Z","cveId":"CVE-2024-12236","cweIds":["CWE-755"],"cvssScore":"5.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Vertex Gemini API","Gemini","Google Cloud Platform Vertex AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Vertex Gemini API data exfiltration via crafted file URI under VPC-SC","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00081,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-3vm2-3vf9-9j39"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T00:11:08.100Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}