CVE-2026-121652

MediumCVSS 5.4/10Last modified Nov 4, 2026

Description

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.

To remediate this issue, users should upgrade to 4.0.3 or later.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1216539.8SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code CVE-2026-121665.5A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser CVE-2026-1216607.5Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216617.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1216628.6Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to CVE-2026-1216638.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216648.3Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker t CVE-2026-1216658.8Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216687.7Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.CVE-2026-1216696.1Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.CVE-2026-121677.8The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver fun CVE-2026-1216707.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized a