CVE-2026-84942: Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from a crafted visualization?
An attacker must be authenticated and have permission to write dashboards. Other users are at risk when their browser renders a saved crafted Vega visualization, because the JavaScript executes in their browser session context.
What is required to trigger the vulnerability?
The attacker must save a Vega visualization containing a function property nested inside an array of objects. This structure bypasses the affected validation routine and requires a user to view or otherwise render the visualization.
Which releases should be reviewed for remediation information?
The provided references include OpenSearch Dashboards releases 3.6.0 and 2.19.5, as well as AWS Security Bulletin 2026-102. The supplied data does not identify the full affected-version range or explicitly state fixed-version applicability.