CVE-2026-121652: Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Published Nov 3, 2026
·Updated
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) placename property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Amplify maplibre-gl-js-amplifyto a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Nov 3, 2026
CVE Published
via MITRE·06:42 PM
Data Sourced
via MITRE·06:42 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:18 PM
DescriptionSeverityWeakness