---
id: CVE-2026-90772
title: >-
  Amundsen frontend through 4.3.0 renders table, dashboard, and feature
  descriptions with dangerouslySetInnerHTML without HTML sanitization in
  ResourceListItem components
summary: >-
  Amundsen frontend through 4.3.0 renders table, dashboard, and feature
  descriptions with dangerouslySetInnerHTML without HTML sanitization in
  ResourceListItem components. Attackers can inject malicious markup like img
  elements with onerro…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-79
vendor: amundsen-io
product: amundsen-frontend
affected:
  - amundsen-frontend <= 4.3.0
published: '2026-09-13'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90772'
references:
  - url: 'https://github.com/amundsen-io/amundsen'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx
    label: disclosure@vulncheck.com
  - url: 'https://github.com/amundsen-io/amundsen/issues/2362'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description
    label: disclosure@vulncheck.com
  - url: 'https://github.com/amundsen-io/amundsen/issues/2362'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00362
epssPercentile: 0.29864
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T17:31:29.641707Z'
ingestedAt: '2026-09-14T15:23:07.471Z'
---

## Overview

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.