8.7
Élevée
CVE-2026-84942 Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote…
Description
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Amazon OpenSearch Service 2.3 | premières → < 2.3.0 | 2.3.0 |
| OpenSearch Dashboards 2.0 | 2.0.0 → 3.5.0 | Pas de correctif indiqué |
Références
- github.com github.com
- github.com github.com
- aws.amazon.com aws.amazon.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Amazon OpenSearch Service
Les 4 CVE de Amazon OpenSearch Service →
CVE-2026-77811
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote…
8.7
Élevée
CVE-2026-18420
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an…
8.8
Élevée
CVE-2026-75897
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload…
7.5
Élevée