EUVD-2026-74074
GHSA-r4c3-6c67-qqwx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS with scope change to victim browsers: PR:L for required write access, UI:R for victim view, S:C/C:H/I:H for full session compromise; no availability impact.
Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).
CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
AnalysisAI
Stored cross-site scripting in OpenSearch Dashboards' Vega visualization engine allows an authenticated user with dashboard write permissions to plant malicious JavaScript that executes in the browser session of any user who subsequently views the crafted dashboard. The checkForFunctionProperty input validation routine failed to recurse into arrays of objects, so a JavaScript function nested within an array structure silently bypassed sandbox enforcement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess an authenticated OpenSearch Dashboards session with dashboard write permissions (at minimum). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (6.3, AV:N/AC:L/AT:N/PR:L/UI:P/SC:H/SI:H) accurately captures the threat model: low-complexity network exploitation requiring a low-privilege authenticated account, passive victim interaction (viewing a dashboard), but with high subsequent-system impact on confidentiality and integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenSearch Dashboards 2.19.5 for 2.x branch deployments or 3.6.0 for 3.x branch deployments; both releases are available at the opensearch-project GitHub (https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.5 and https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.6.0) and are documented in the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-102-aws/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today