VulnSocial

CVE-2026-121652

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-04: 111-04
Referenced assets1 URL
By indicator
Full discourse1 post
  • 星野ぽぽぽ / キュアクラウド@hoshino_popopo_

    AWS Amplify の地図表示ライブラリに XSS 修正が入ったよ maplibre-gl-js-amplify 4.0.2 以下では、地図の情報に仕込まれたスクリプトが別の利用者のブラウザで実行されるおそれがあったよ。なにそれこわい 使っている人は 4.0.3 以降へ更新してね。 CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering https://aws.amazon.com/security/security-bulletins/2026-167-aws/

    00031377
    8.4K followersView on X

Explore more

Back to dashboard