Maplibre Gl Js Amplify
Monthly
Stored cross-site scripting in AWS Amplify's maplibre-gl-js-amplify library (versions through 4.0.2) lets an authenticated user who can write location or geofence data persist an HTML/JavaScript payload that later executes in a different user's browser session when the affected map popup or geofence list item is rendered. The vulnerable sinks are the GeoJSON feature properties title, address and place_name used by popupRender, plus the geofenceId value rendered in AmplifyGeofenceControl list items and the delete-confirmation prompt; the payload fires only when a victim interacts with the element, such as clicking the marker or opening/deleting a geofence entry, so this is not a drive-by issue. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch is version 4.0.3, which escapes the affected values via a new escapeHtml() utility.
Stored cross-site scripting in AWS Amplify's maplibre-gl-js-amplify library (versions through 4.0.2) lets an authenticated user who can write location or geofence data persist an HTML/JavaScript payload that later executes in a different user's browser session when the affected map popup or geofence list item is rendered. The vulnerable sinks are the GeoJSON feature properties title, address and place_name used by popupRender, plus the geofenceId value rendered in AmplifyGeofenceControl list items and the delete-confirmation prompt; the payload fires only when a victim interacts with the element, such as clicking the marker or opening/deleting a geofence entry, so this is not a drive-by issue. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch is version 4.0.3, which escapes the affected values via a new escapeHtml() utility.