Dashboard / CVE-2026-121652

CVE-2026-121652

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-11-03 Modified: 2026-11-04 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Active
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
AWS maplibre-gl-js-amplify 0 < 4.0.3
AWS maplibre-gl-js-amplify 0 < 4.0.3

References & Advisories (3)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.26%
Raw Score 0.002640
Percentile 18.4%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00264
2026-11-13
0.00264
2026-11-12
0.00264
2026-11-10
0.00264
2026-11-09
0.00264
2026-11-08
0.00264
2026-11-07
0.00264
2026-11-06
0.00264
2026-11-05
0.00264
2026-11-04
0.00264

Intelligence Sources

mitre ref →
nvd ref →

External Links