{"id":"CVE-2026-121652","kind":"vulnerability","aliases":["CVE-2026-121652"],"related":[],"title":"Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…","description":"CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering\n\n### CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering\n\nBulletin ID: 2026-167-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/03/2026 10:30 AM PST\n\nDescription:\n\nmaplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Several code paths interpolated user-controlled GeoJSON feature properties (`title`, address, and place_name) and geofence identifiers directly into the DOM via innerHTML without sanitization. An actor who stored a crafted location record or geofence identifier containing an HTML/JavaScript payload could cause that payload to execute in another user's browser when the corresponding map marker or geofence list item was rendered. In an authenticated session this could enable actions such as session hijacking or data exfiltration in the context of the consuming application.\n\nImpacted versions: <= 4.0.2\n\nResolution:\n\nThis issue has been addressed in maplibre-gl-js-amplify version 4.0.3. The fix introduces an escapeHtml() utility that is applied to all affected user-controlled values before they are inserted into the DOM. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround that fully addresses this issue; upgrading to version 4.0.3 or later is required. As defense in depth, applications that cannot upgrade immediately should validate and sanitize all user-supplied location and geofence data (notably title, address, place_name, and geofence identifiers) on input, and apply a restrictive Content Security Policy to limit the impact of injected script.\n\nReferences:\n\n- CVE-2026-121652\n- GHSA-34v3-xxqp-g5g9\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The maplibre-gl-js-amplify library inserted user-controlled map location fields and geofence identifiers into the page without escaping. An attacker who stores a crafted location record can run script in another user's browser when that marker or geofence list is rendered, enabling session hijacking or data theft in the consuming app.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-location-service","aws","aws-amplify","lab-disclosure","maplibre","package","web-frontend"],"not_affected_if":["no-user-stored-location-data","upgraded-to-4.0.3"],"how_to_check":"- Find `maplibre-gl-js-amplify` in your `package.json` or lockfile and read the installed version.\n- Check whether the app renders stored location titles, addresses, place names or geofence IDs from users in map popups.","fix":"- `maplibre-gl-js-amplify` `4.0.3` or later (versions `<= 4.0.2` are affected); the bulletin says forked or derivative code must also be patched.","status":"open","published_at":"2026-11-03T19:18:05+00:00","first_seen_at":"2026-11-03T19:36:41+00:00","triaged_at":"2026-11-03T19:37:16+00:00","updated_at":"2026-11-03T19:44:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T19:37:16Z","model":"claude-haiku-5-5","output":{"fix":"- `maplibre-gl-js-amplify` `4.0.3` or later (versions `<= 4.0.2` are affected); the bulletin says forked or derivative code must also be patched.","reach":"internet","title":"AWS Amplify maplibre library: stored XSS in map popups","impact":"high","summary":"The maplibre-gl-js-amplify library inserted user-controlled map location fields and geofence identifiers into the page without escaping. An attacker who stores a crafted location record can run script in another user's browser when that marker or geofence list is rendered, enabling session hijacking or data theft in the consuming app.","audience":"developers","category":"package","nicknames":[],"who_cares":["aws-amplify","maplibre","web-frontend","amazon-location-service"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in other users' browsers, enabling session hijacking","analyst_note":"","how_to_check":"- Find `maplibre-gl-js-amplify` in your `package.json` or lockfile and read the installed version.\n- Check whether the app renders stored location titles, addresses, place names or geofence IDs from users in map popups.","plain_action":"","needs_analyst":false,"not_affected_if":["upgraded-to-4.0.3","no-user-stored-location-data"],"who_is_affected":"Web applications that use maplibre-gl-js-amplify to show map markers, popups or geofence controls built from data users can store. Apps that only show fixed or internally generated location data are less exposed, though the bulletin does not spell out that boundary. The bulletin says no workaround fully fixes the issue; input validation and a restrictive Content Security Policy only reduce impact.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000801,"input_tokens":4885,"output_tokens":626,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121652':23A,26A,101C,120C,194C,426C '-167':140C '-2026':22A,25A,100C,119C,193C,425C '10':152C '11/03/2026':151C '2026':139C '30':153C '34v3':429C '4.0.2':301C '4.0.3':16A,315C,373C 'action':284C 'actor':241C 'address':225C,307C,367C,401C 'affect':327C 'allow':18A 'amazon':28B,172C 'amazon-location-servic':27B 'amplifi':9A,14A,34B,48B,110C,115C,129C,134C,161C,168C,313C 'anoth':77B,262C 'app':98B 'appli':324C,410C 'applic':189C,298C,382C 'attack':66B 'attent':148C 'authent':20A,279C 'aw':8A,31B,33B,109C,128C,141C,143C,167C 'aws-amplifi':32B 'aws-security@amazon.com':434C 'browser':80B,265C 'bulletin':137C 'cannot':384C 'caus':256C 'code':215C,352C 'concern':440C 'consum':97B,297C 'contain':251C 'content':144C,413C 'context':294C 'control':53B,186C,212C,220C,330C 'correspond':268C 'could':255C,282C 'craft':70B,245C 'cross':2A,104C,123C,199C 'cross-sit':1A,103C,122C,198C 'cve':21A,24A,99C,118C,192C,424C 'data':93B,290C,398C 'date':150C 'defens':379C 'depth':381C 'deriv':351C 'descript':156C 'direct':232C 'disclosur':37B 'dom':235C,338C 'email':433C 'enabl':89B,283C 'ensur':347C 'escap':64B 'escapehtml':320C 'execut':260C 'exfiltr':291C 'featur':222C 'field':56B 'fix':317C,359C 'fork':349C 'frontend':42B 'fulli':366C 'g5g9':431C 'geofenc':58B,85B,185C,211C,230C,249C,272C,397C,405C 'geofence-control':210C 'geojson':221C 'ghsa':428C 'ghsa-34v3-xxqp-g5g9':427C 'gl':12A,46B,113C,132C,159C,177C,311C 'hijack':91B,288C 'html/javascript':253C 'id':138C 'identifi':59B,191C,231C,250C,406C 'immedi':386C 'impact':299C,419C 'import':146C 'incorpor':356C 'inject':421C 'innerhtml':237C 'input':408C 'insert':50B,335C 'integr':171C 'interpol':217C 'introduc':318C 'issu':6A,203C,304C,369C 'item':274C 'js':13A,47B,114C,133C,160C,178C,312C 'lab':36B 'lab-disclosur':35B 'later':375C 'latest':344C 'librari':49B,169C,206C 'limit':417C 'list':86B,273C 'locat':29B,55B,71B,173C,246C,395C 'map':54B,181C,269C 'maplibr':11A,38B,45B,112C,131C,158C,176C,310C 'maplibre-gl-js-amplifi':10A,44B,111C,130C,157C,309C 'marker':83B,182C,270C 'might':17A 'name':228C,403C 'new':358C 'notabl':399C 'open':165C 'open-sourc':164C 'packag':39B 'page':62B 'patch':354C 'path':216C 'payload':254C,258C 'place':227C,402C 'pleas':432C 'polici':415C 'popup':116C,135C,183C,208C 'properti':223C 'pst':155C 'public':149C 'question':438C 'recommend':340C 'record':72B,247C 'refer':423C 'remot':19A 'render':88B,117C,136C,180C,213C,276C 'requir':147C,377C 'resolut':302C 'restrict':412C 'run':74B 'sanit':239C,390C 'scope':142C 'script':4A,75B,106C,125C,201C,422C 'secur':414C,437C 'servic':30B,174C 'session':90B,280C,287C 'sever':214C 'site':3A,105C,124C,200C 'sourc':166C 'store':68B,102C,121C,197C,243C 'suppli':394C 'theft':94B 'titl':224C,400C 'type':145C 'upgrad':341C,370C,385C 'user':52B,78B,219C,263C,329C,393C 'user-control':51B,218C,328C 'user-suppli':392C 'util':321C 'valid':388C 'valu':331C 'version':300C,314C,345C,372C 'via':236C 'web':41B,188C 'web-frontend':40B 'without':63B,238C 'workaround':360C,364C 'xss':5A,107C,126C,202C 'xxqp':430C","nicknames":[],"mitigations":[],"who_affected":"Web applications that use maplibre-gl-js-amplify to show map markers, popups or geofence controls built from data users can store. Apps that only show fixed or internally generated location data are less exposed, though the bulletin does not spell out that boundary. The bulletin says no workaround fully fixes the issue; input validation and a restrictive Content Security Policy only reduce impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amazonlocationservice","aws","awsamplify","labdisclosure","maplibre","medium","package","webfrontend"],"campaign_type":null,"first_public_at":"2026-11-03T18:43:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-167-aws/#CVE-2026-121652","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-167-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T19:36:41+00:00","fetched_at":"2026-11-03T19:36:41+00:00","note":"AWS: CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering"},{"source":"nvd","external_id":"CVE-2026-121652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121652","severity":null,"published_at":"2026-11-03T19:18:05+00:00","modified_at":"2026-11-03T19:18:05+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:53+00:00","note":null}],"documents":[{"id":60128,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-167-aws/","title":"AWS: CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering\n\n### CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering\n\nBulletin ID: 2026-167-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/03/2026 10:30 AM PST\n\nDescription:\n\nmaplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Several code paths interpolated user-controlled GeoJSON feature properties (`title`, address, and place_name) and geofence identifiers directly into the DOM via innerHTML without sanitization. An actor who stored a crafted location record or geofence identifier containing an HTML/JavaScript payload could cause that payload to execute in another user's browser when the corresponding map marker or geofence list item was rendered. In an authenticated session this could enable actions such as session hijacking or data exfiltration in the context of the consuming application.\n\nImpacted versions: <= 4.0.2\n\nResolution:\n\nThis issue has been addressed in maplibre-gl-js-amplify version 4.0.3. The fix introduces an escapeHtml() utility that is applied to all affected user-controlled values before they are inserted into the DOM. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround that fully addresses this issue; upgrading to version 4.0.3 or later is required. As defense in depth, applications that cannot upgrade immediately should validate and sanitize all user-supplied location and geofence data (notably title, address, place_name, and geofence identifiers) on input, and apply a restrictive Content Security Policy to limit the impact of injected script.\n\nReferences:\n\n- CVE-2026-121652\n- GHSA-34v3-xxqp-g5g9\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":60189,"url":"https://github.com/aws-amplify/maplibre-gl-js-amplify/releases/tag/v4.0.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60190,"url":"https://github.com/aws-amplify/maplibre-gl-js-amplify/security/advisories/GHSA-34v3-xxqp-g5g9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T18:43:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}