CVE-2026-121652
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- First covered by RedTeamDaily
- Published by NVD
- Last updated by NVD
Coverage
AWS Amplify maplibre-gl-js-amplify stored XSS flaw tracked as CVE-2026-121652
AWS has published bulletin 2026-167-AWS, dated 11/03/2026, for CVE-2026-121652, a stored cross-site scripting issue in the popup and geofence-control rendering of the maplibre-gl-js-amplify library. The library integrates Amazon Location Service with MapLibre GL JS, and versions 4.0.2 and earlier are affected.
Sources: NVD and CISA known exploited vulnerabilities catalogue.