CVE-2026-84942mediumCWE-79

CVE-2026-84942: falha de média gravidade em OpenSearch Dashboards

Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Amazon OpenSearch Service+ Monitorar OpenSearch Dashboards

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
AWS · Amazon OpenSearch ServiceOpenSearch · OpenSearch Dashboards
CVEs relacionadas — OpenSearch Dashboards

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18420HIGHRCE via Prototype Pollution in OpenSearch DashboardsEPSS 1.0%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2026-77811MEDIUMStored Cross-Site Scripting via Integration Template Asset in OpenSearch DashboardsEPSS 0.5%