CVE-2026-121652Medium· 5.4▾ SunlitCross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON featu…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
maplibre-gl-js-amplify < 4.0.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120497Medium· 5.0Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
CVE-2026-84942High· 8.7Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser…
CVE-2026-119084High· 8.1Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
CVE-2026-119922High· 8.8Babelfish for PostgreSQL Privilege Escalation
CVE-2026-119085High· 8.8Template injection in the publishing component of awslabs Virtual Engineering Workbench
CVE-2026-116635Medium· 6.1Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server