CVE-2026-90772: fallo de gravedad alta en amundsen-io amundsen-frontend
Amundsen Frontend through 4.3.0 Stored XSS via Description
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.4%
probabilidad de explotación
0.4%top 72% de las CVE
explotación observada
noninguna fuente lo reporta
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Productos afectados
amundsen-io · amundsen-frontendReferencias
https://github.com/amundsen-io/amundsenhttps://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsxhttps://github.com/amundsen-io/amundsen/issues/2362https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description