High
Amundsen Frontend through 4.3.0 Stored XSS via Description
Type: advisorySources: OSV
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-90772
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 18:03 UTC · Revision 1
Source evidence
Amundsen Frontend through 4.3.0 Stored XSS via Description
core-osv · Original sourcePublished 13 Sept 2026, 10:45 UTC
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
osv:CVE-2026-90772
Complete source record
{
"id": "dcad7c5d91c2b08504a61a4df82520b9e8862afd4238bf36a8b34eba2ccd7baa",
"url": "https://osv.dev/vulnerability/CVE-2026-90772",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Amundsen Frontend through 4.3.0 Stored XSS via Description",
"summary": "Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.",
"evidence": "osv:CVE-2026-90772",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-90772",
"aliases": [
"CVE-2026-90772"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/amundsen-io/amundsen",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "125b04ff9f696091e2e5ff696ab8ad201580385d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.3.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.3.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"search-4.2.0",
"metadata-3.13.0",
"frontend-4.3.0",
"common-0.32.0",
"metadata-3.12.3",
"databuilder-7.4.6",
"databuilder-7.4.5",
"metadata-3.12.2",
"databuilder-7.4.4",
"search-4.1.1",
"metadata-3.12.1",
"common-0.31.0",
"databuilder-7.4.3",
"common-0.30.0",
"common-0.29.0",
"common-0.28.0",
"databuilder-7.4.2",
"databuilder-7.4.1",
"databuilder-7.4.0",
"databuilder-7.3.0",
"databuilder-7.2.1",
"databuilder-7.2.0",
"databuilder-7.1.2",
"databuilder-7.1.1",
"databuilder-7.1.0",
"databuilder-7.0.0",
"metadata-3.11.0",
"databuilder-6.12.0",
"databuilder-6.11.1",
"databuilder-6.11.0",
"databuilder-6.10.0",
"databuilder-6.9.0",
"frontend-4.2.0",
"search-4.0.2",
"frontend-4.1.2",
"search-3.1.1",
"frontend-4.0.1",
"databuilder-6.8.0",
"common-0.27.1",
"common-0.27.0",
"databuilder-6.7.5",
"common-0.26.2",
"common-0.26.1",
"databuilder-6.7.4",
"databuilder-6.7.3",
"databuilder-6.7.2",
"databuilder-6.7.1",
"common-0.26.0",
"databuilder-6.7.0",
"search-3.1.0",
"databuilder-6.6.0",
"common-0.25.0",
"databuilder-6.5.2",
"databuilder-6.5.1",
"databuilder-6.5.0",
"databuilder-6.4.6",
"databuilder-6.4.5",
"databuilder-6.4.4",
"databuilder-6.4.3",
"databuilder-6.4.2",
"search-3.0.0",
"frontend-4.0.0",
"common-0.24.1",
"common-0.24.0",
"databuilder-6.4.1",
"common-0.23.0",
"databuilder-6.4.0",
"common-0.22.0",
"databuilder-6.3.1",
"metadata-3.10.0",
"databuilder-6.3.0",
"common-0.21.0",
"metadata-3.9.1",
"frontend-3.13.0",
"databuilder-6.2.2",
"daatbuilder-6.2.2",
"databuilder-6.2.1",
"databuilder-6.2.0",
"databuilder-6.1.1",
"databuilder-6.1.0",
"common-0.20.0",
"databuilder-6.0.3",
"search-2.11.1",
"databuilder-6.0.2",
"databuilder-6.0.1",
"databuilder-5.2.5",
"metadata-3.9.0",
"databuilder-6.0.0",
"common-0.19.0",
"databuilder-5.2.6",
"frontend-3.12.0",
"common-0.18.2",
"databuilder-5.2.4",
"databuilder-5.2.3",
"metadata-3.8.1",
"metadata-3.8.0",
"frontend-3.11.1",
"databuilder-5.2.2",
"databuilder-5.2.1",
"common-0.18.1",
"common-0.18.0",
"frontend-3.11.0",
"search-2.10.0",
"metadata-3.7.0",
"frontend-3.10.0",
"common-0.17.0",
"databuilder-5.2.0",
"search-2.9.0",
"metadata-3.6.0",
"frontend-3.9.0",
"common-0.16.0",
"common-0.15.3",
"search-2.8.0",
"databuilder-5.1.0",
"common-0.15.2",
"common-0.15.1",
"search-2.6.0",
"databuilder-5.0.0",
"common-0.15.0",
"common-0.14.0",
"databuilder-4.5.3",
"databuilder-4.5.2",
"databuilder-4.5.1",
"databuilder-4.5.0",
"common-0.13.0-fix2",
"common-0.13.0-fix1",
"common-0.13.0",
"common-0.12.0",
"databuilder-4.4.1",
"common-0.11.0",
"common-0.10.1",
"databuilder-4.4.0-fix1",
"databuilder-4.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90772.json"
}
}
],
"modified": "2026-10-28T02:30:31.267516691Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90772.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-90772",
"https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description",
"https://github.com/amundsen-io/amundsen/issues/2362",
"https://github.com/amundsen-io/amundsen",
"https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90772.json"
}
},
"related_cves": [
{
"value": "CVE-2026-90772",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 498138,
"published_at": "2026-09-13T10:45:43.246+00:00"
}