Vulnerability · 1 source · latest 6h

AWS Amplify maplibre-gl-js-amplify stored XSS flaw tracked as CVE-2026-121652

VULNERABILITYCVE-2026-121652redteam/daily · 1 source

Severity: Medium
Highest CVSS: 4.8
Exploited: Not known
Sources: 1

What happened

CVE-2026-121652 is a stored XSS vulnerability in the popup and geofence-control rendering of maplibre-gl-js-amplify, an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS. Versions 4.0.2 and earlier are affected, as stated in AWS Security Bulletin 2026-167-AWS (published 11/03/2026). The article does not state a fixed version or CVSS score, so defenders should check their dependency versions and consult the bulletin for remediation guidance.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check whether your web applications use maplibre-gl-js-amplify at version 4.0.2 or earlier.
Follow the remediation guidance in AWS Security Bulletin 2026-167-AWS.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-121652CVSS 4.8Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value re

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins