What’s Vulnerable › Vulnerabilities

CVE-2024-54160

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-12 · updated 2026-06-17
• Weakness: CWE-79

Description

dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewing a header or footer.

Affected products

• LF Projects OpenSearch: before 2.19 — fixed in 2.19

How to fix

Upgrade to a fixed version: LF Projects OpenSearch 2.19. Check the vendor advisory for mitigations.

References

• https://github.com/Jflye/CVE-2024-54160--Opensearch-HTML-Injection
• https://github.com/opensearch-project/dashboards-reporting/compare/2.18.0.0...2.19.0.0
• https://github.com/opensearch-project/dashboards-reporting/pull/476
• https://github.com/opensearch-project/opensearch-build/blob/main/release-notes/opensearch-release-notes-2.19.0.md
• https://opensearch.org/releases.html

Get alerted when CVE-2024-54160 or the next vulnerability affects your stack