Vulnerabilities

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web…

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

AWS

Product

maplibre-gl-js-amplify

CVSS v3.1

5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix

available

Weakness

CWE-79

Exposure class

Cloud platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-121652 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 40
   AWS bulletin AWS 6h ago

   CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

   CVE-2026-121652 Amazon Web Services