{"id":"CVE-2026-90772","summary":"Amundsen Frontend through 4.3.0 Stored XSS via Description","details":"Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.","modified":"2026-09-16T03:30:49.138116591Z","published":"2026-09-13T10:45:43.246Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90772.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90772.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90772"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description"},{"type":"REPORT","url":"https://github.com/amundsen-io/amundsen/issues/2362"},{"type":"PACKAGE","url":"https://github.com/amundsen-io/amundsen"},{"type":"ARTICLE","url":"https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/amundsen-io/amundsen","events":[{"introduced":"0"},{"fixed":"125b04ff9f696091e2e5ff696ab8ad201580385d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.3.0"},{"fixed":"4.3.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["metadata-3.12.3","databuilder-7.4.6","databuilder-7.4.5","metadata-3.12.2","databuilder-7.4.4","search-4.1.1","metadata-3.12.1","common-0.31.0","databuilder-7.4.3","common-0.30.0","common-0.29.0","common-0.28.0","databuilder-7.4.2","databuilder-7.4.1","databuilder-7.4.0","databuilder-7.3.0","databuilder-7.2.1","databuilder-7.2.0","databuilder-7.1.2","databuilder-7.1.1","databuilder-7.1.0","databuilder-7.0.0","metadata-3.11.0","databuilder-6.12.0","databuilder-6.11.1","databuilder-6.11.0","databuilder-6.10.0","databuilder-6.9.0","frontend-4.2.0","search-4.0.2","frontend-4.1.2","search-3.1.1","frontend-4.0.1","databuilder-6.8.0","common-0.27.1","common-0.27.0","databuilder-6.7.5","common-0.26.2","common-0.26.1","databuilder-6.7.4","databuilder-6.7.3","databuilder-6.7.2","databuilder-6.7.1","common-0.26.0","databuilder-6.7.0","search-3.1.0","databuilder-6.6.0","common-0.25.0","databuilder-6.5.2","databuilder-6.5.1","databuilder-6.5.0","databuilder-6.4.6","databuilder-6.4.5","databuilder-6.4.4","databuilder-6.4.3","databuilder-6.4.2","search-3.0.0","frontend-4.0.0","common-0.24.1","common-0.24.0","databuilder-6.4.1","common-0.23.0","databuilder-6.4.0","common-0.22.0","databuilder-6.3.1","metadata-3.10.0","databuilder-6.3.0","common-0.21.0","metadata-3.9.1","frontend-3.13.0","databuilder-6.2.2","daatbuilder-6.2.2","databuilder-6.2.1","databuilder-6.2.0","databuilder-6.1.1","databuilder-6.1.0","common-0.20.0","databuilder-6.0.3","search-2.11.1","databuilder-6.0.2","databuilder-6.0.1","databuilder-5.2.5","metadata-3.9.0","databuilder-6.0.0","common-0.19.0","databuilder-5.2.6","frontend-3.12.0","common-0.18.2","databuilder-5.2.4","databuilder-5.2.3","metadata-3.8.1","metadata-3.8.0","frontend-3.11.1","databuilder-5.2.2","databuilder-5.2.1","common-0.18.1","common-0.18.0","frontend-3.11.0","search-2.10.0","metadata-3.7.0","frontend-3.10.0","common-0.17.0","databuilder-5.2.0","search-2.9.0","metadata-3.6.0","frontend-3.9.0","common-0.16.0","common-0.15.3","search-2.8.0","databuilder-5.1.0","common-0.15.2","common-0.15.1","search-2.6.0","databuilder-5.0.0","common-0.15.0","common-0.14.0","databuilder-4.5.3","databuilder-4.5.2","databuilder-4.5.1","databuilder-4.5.0","common-0.13.0-fix2","common-0.13.0-fix1","common-0.13.0","common-0.12.0","databuilder-4.4.1","common-0.11.0","common-0.10.1","databuilder-4.4.0-fix1","databuilder-4.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90772.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"}]}