8.7
High
CVE-2026-84942 Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote…
Description
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Amazon OpenSearch Service 2.3 | earliest → < 2.3.0 | 2.3.0 |
| OpenSearch Dashboards 2.0 | 2.0.0 → 3.5.0 | No fix stated |
References
- github.com github.com
- github.com github.com
- aws.amazon.com aws.amazon.com
Timeline
- Published
- Last modified
Other CVEs of Amazon OpenSearch Service
The 4 CVEs of Amazon OpenSearch Service →
CVE-2026-77811
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote…
8.7
High
CVE-2026-18420
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an…
8.8
High
CVE-2026-75897
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload…
7.5
High