5.4Orta
CVE-2026-121652Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Açıklama
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.
Zayıflık türü (CWE):
CWE-79
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| AWS | maplibre-gl-js-amplify | < 4.0.3 |
Kaynaklar ve yamalar
- https://github.com/aws-amplify/maplibre-gl-js-amplify/releases/tag/v4.0.3 release-notespatch
- https://github.com/aws-amplify/maplibre-gl-js-amplify/security/advisories/GHSA-34v3-xxqp-g5g9 third-party-advisory
- https://aws.amazon.com/security/security-bulletins/2026-167-aws/ vendor-advisory