Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-09 | 1 | Disclosure1 |
| 2026-09-11 | 1 | Patch1 |
dashboard write was enough. cve-2026-84942 is stored xss in vega on opensearch dashboards. opening the viz runs the payload. patch the service software or disable vega. #vulnerability #CVE
Post summary
The post identifies a stored XSS vulnerability (CVE‑2026‑84942) in OpenSearch Dashboards, notifies users that opening a viz triggers the payload, and recommends patching the service or disabling Vega.
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards https://dlvr.it/TVPMF0 #patchmanagement
Post summary
CVE‑2026‑84942 is a stored XSS vulnerability in OpenSearch Dashboards caused by a Vega Expression Function bypass. No PoC, exploit code, patch details, or active exploitation claims are provided.