Cross-site scripting in AWS Amplify MapLibreGLJSAmplify <4.0.3 via GeoJSON popupRender
CVE-2026-121652 Published on November 3, 2026
Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
Vulnerability Analysis
CVE-2026-121652 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-121652 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-121652
Want to know whenever a new CVE is published for Aws Maplibre Gl Js Amplify? stack.watch will email you.
Affected Versions
AWS maplibre-gl-js-amplify:- Before 4.0.3 is affected.