CVE-2026-90772 — Amundsen Frontend through 4.3.0 Stored XSS via Description
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attacke…
Published: 2026-09-13 · CVSS: 8.3 · CVSS 4.0
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7