CVE-2026-84942: Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Severity: high (CVSS 8.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-09-09
Weakness: CWE-79

Description

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

Affected products

OpenSearch Dashboards: from v2.0.0 through v3.5.0

References

https://aws.amazon.com/security/security-bulletins/2026-102-aws/
https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.5
https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.6.0

Get alerted when CVE-2026-84942 or the next vulnerability affects your stack