Vulnerability · 1 source · latest 5h

AWS Amplify maplibre-gl-js-amplify stored XSS flaw tracked as CVE-2026-121652

VULNERABILITYCVE-2026-121652redteam/daily · 1 source

Severity: Medium
Highest CVSS: 4.8
Exploited: Not known
Sources: 1

What happened

AWS has published bulletin 2026-167-AWS, dated 11/03/2026, for CVE-2026-121652, a stored cross-site scripting issue in the popup and geofence-control rendering of the maplibre-gl-js-amplify library. The library integrates Amazon Location Service with MapLibre GL JS, and versions 4.0.2 and earlier are affected.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check whether your web applications use maplibre-gl-js-amplify at version 4.0.2 or earlier.
Follow the remediation guidance in AWS Security Bulletin 2026-167-AWS.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-121652CVSS 4.8Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value re

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins