maplibre-gl-js-amplify CVE-2026-121652

Exploitation requires an authenticated actor who can persist attacker-controlled location or geofence data through the consuming application - specifically a GeoJSON feature 'title', 'address', or 'place_name' property rendered by popupRender, or a 'geofenceId' rendered in AmplifyGeofenceControl list items and the delete-confirmation prompt (library versions <= 4.0.2). The payload only executes when a victim actively interacts with the rendered element, e.g. clicking the affected map marker or viewing/deleting the geofence list item (UI:A). Limiting factors: the attacker must already hold write access to these fields (PR:L, not unauthenticated), the application must actually use these rendering paths, and a second user must trigger the render - so it is not drive-by. There is no complete workaround; upgrading to 4.0.3 or later is required. As defense in depth the vendor suggests validating/sanitizing title, address, place_name, and geofence identifiers on input and applying a restrictive Content Security Policy.

This is a genuinely medium-severity, lower-priority issue rather than a high-CVSS-but-low-real-risk mismatch - the signals are internally consistent. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) describes a network-reachable but privilege- and interaction-gated flaw: PR:L means the attacker must already be an authenticated user of the consuming application able to store location/geofence records, and UI:A means a victim must actively interact (e.g. click a map marker) for the stored payload to fire. Impact is limited (VC:L/VI:L, no availability impact), consistent with a stored XSS running in the victim's browser context. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the medium score. No CISA KEV listing and no EPSS score were supplied, so there is no evidence of active exploitation or elevated exploitation probability; treat exploitation likelihood as unquantified rather than low-confirmed. No PoC or exploit reference is present in the input - only a vendor patch, the GHSA advisory, and an AWS security bulletin. There are no conflicting signals: the stored-XSS mechanism, the authenticated precondition, and the required victim interaction are all corroborated by the vendor GHSA advisory and source-code evidence. Net priority: schedule the upgrade within a normal patch cycle; it is not an emergency.

An authenticated user of an application built on maplibre-gl-js-amplify stores a crafted record whose title, address, or place_name GeoJSON property (or a geofenceId) contains an HTML/JavaScript payload. When another authenticated user later renders the map and interacts with the corresponding marker or geofence list item, the unsanitized value is written to the DOM via innerHTML and the script executes in the victim's session, enabling session hijacking or data exfiltration. No public exploit identified at time of analysis; the trigger path is confirmed by the vendor GHSA advisory and the v4.0.3 fix commit.