CVE-2026-121652

Cross-site scripting XSS issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the 1 title, 2 address, or 3 placename property in GeoJSON feature data rendered by popupRender, or the 4 geofenceId value rendered i...

EUVD-2026-116136

Cross-site scripting XSS issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the 1 title, 2 address, or 3 placename property in GeoJSON feature data rendered by popupRender, or the 4 geofenceId value rendered i...

CVE-2026-121652 Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Cross-site scripting XSS issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the 1 title, 2 address, or 3 placename property in GeoJSON feature data rendered by popupRender, or the 4 geofenceId value rendered i...

CVE-2026-121652

A Cross-site scripting (XSS) vulnerability exists in AWS Amplify maplibre-gl-js-amplify versions before 4.0.3 . The issue allows remote authenticated users to inject arbitrary web scripts or HTML. The vulnerability is triggered through the (1) title , (2) address , or (3) place_name properties in...