What’s Vulnerable › Vulnerabilities

CVE-2026-90772: Amundsen Frontend through 4.3.0 Stored XSS via Description

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-13 · updated 2026-09-24
• Weakness: CWE-79

Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

Affected products

• amundsen-io amundsen-frontend: through 4.3.0

References

• https://github.com/amundsen-io/amundsen
• https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx
• https://github.com/amundsen-io/amundsen/issues/2362
• https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description
• https://github.com/amundsen-io/amundsen/issues/2362

Get alerted when CVE-2026-90772 or the next vulnerability affects your stack