Live › vulnerability › GHSA-34v3-xxqp-g5g9
maplibre-gl-js-amplify inserts stored location and geofence fields into the page without escaping. A crafted record can run script in another user's browser when its map marker or geofence item is shown, enabling session hijacking or data theft in an authenticated session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:36 UTC. All times on this page are UTC.
Web applications that use maplibre-gl-js-amplify at version 4.0.2 or earlier to render Amazon Location Service markers, popups or geofence lists from user-stored data. Applications not using this library, or using versions 4.0.3 or later, are not affected; forked or copied code needs the same patch.
No product ranges from the sources yet.
maplibre-gl-js-amplify version in package.json or the lockfileinnerHTML usage on title, address, place_name or geofence identifiersmaplibre-gl-js-amplify 4.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Bulletin ID: 2026-167-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/03/2026 10:30 AM PST
Description:
maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Several code paths interpolated user-controlled GeoJSON feature properties (title, address, and place_name) and geofence identifiers directly into the DOM via innerHTML without sanitization. An actor who stored a crafted location record or geofence identifier containing an HTML/JavaScript payload could cause that payload to execute in another user's browser when the corresponding map marker or geofence list item was rendered. In an authenticated session this could enable actions such as session hijacking or data exfiltration in the context of the consuming application.
Impacted versions: <= 4.0.2
Resolution:
This issue has been addressed in maplibre-gl-js-amplify version 4.0.3. The fix introduces an escapeHtml() utility that is applied to all affected user-controlled values before they are inserted into the DOM. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround that fully addresses this issue; upgrading to version 4.0.3 or later is required. As defense in depth, applications that cannot upgrade immediately should validate and sanitize all user-supplied location and geofence data (notably title, address, place_name, and geofence identifiers) on input, and apply a restrictive Content Security Policy to limit the impact of injected script.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-34v3-xxqp-g5g9")