CVE-2026-90772 Details
Description
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
A stored cross-site scripting vulnerability has been identified in the Amundsen frontend application, affecting versions through 4.3.0. The issue arises because table, dashboard, and feature descriptions are rendered using dangerouslySetInnerHTML without proper HTML sanitization. This flaw allows attackers to inject malicious HTML, such as images with onerror event handlers, into the descriptions via the metadata service or Elasticsearch. When these descriptions are viewed in search results, the injected JavaScript is executed in the user's browser.
Sanitize the description before rendering it with dangerouslySetInnerHTML. Alternatively, use standard React text rendering to avoid the need for sanitization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/amundsen-io/amundsen/issues/2362 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/amundsen-io/amundsen | [email protected] | Source CodeVendor |
| https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx | [email protected] | Source CodeVendor |
| https://github.com/amundsen-io/amundsen/issues/2362 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Amundsen | <= 4.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |