Vulnerability · 1 source · latest 6h

AWS Amplify maplibre-gl-js-amplify stored XSS flaw tracked as CVE-2026-121652

VULNERABILITYCVE-2026-121652redteam/daily · 1 source

Severity: Medium
Highest CVSS: 4.8
Exploited: Not known
Sources: 1

What happened

A security flaw has been found in a tool that helps websites show maps and markers. It could let harmful code be hidden in map pop-ups and run in visitors' browsers. Amazon Web Services has published a bulletin about it.

Like I’m new · Written by AI from 1 source · Wrong?

What to do

Check whether your web applications use maplibre-gl-js-amplify at version 4.0.2 or earlier.
Follow the remediation guidance in AWS Security Bulletin 2026-167-AWS.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-121652CVSS 4.8Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value re

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins