CVE-2026-90772— Amundsen Frontend through 4.3.0 Stored XSS via Description
Quick assessment
Affected
amundsen-io amundsen-frontend
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Amundsen 前端 4.3.0 及之前版本中， 组件使用 渲染表、仪表板和特征的描述信息，但未对 HTML 进行净化（sanitization）。攻击者可以通过元数据服务或 Elasticsearch，将带有 事件处理函数的 元素等恶意标记注入到描述信息中，从而在查看搜索结果的所有用户的浏览器中执行 JavaScript 代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90772
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Amundsen Frontend through 4.3.0 Stored XSS via Description
Source: CVE Program / CVE List V5
Vulnerability Description
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| amundsen-io | amundsen-frontend | 0 ~ 4.3.0 | - |
|
II. Public POCs for CVE-2026-90772
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90772
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90772 (1)
Other References for CVE-2026-90772 (2)
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-90502
stilleshan ServerStatus Stats Generation main.cpp cross site -
CVE-2026-90497
Fengoffice Feng Office Task Title Output add_task.php getTit -
CVE-2026-90489
Xuxueli xxl-job insert cross site scripting -
CVE-2026-10148
Booking for Appointments and Events Calendar – Amelia <= 2.4
V. Comments for CVE-2026-90772
No comments yet