CVE-2026-90772

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772

Amundsen frontend through 4.3.0 is affected by a stored XSS in ResourceListItem components (e.g., TableListItem), which render table, dashboard, and feature descriptions using dangerouslySetInnerHTML without HTML sanitization. An attacker with low privileges can inject malicious markup (such as )...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

EUVD-2026-76993

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

PT-2026-90839

Name of the Vulnerable Software and Affected Versions Amundsen frontend versions prior to 4.3.1 Description The frontend renders table, dashboard, and feature descriptions using the dangerouslySetInnerHTML property without proper HTML sanitization within the ResourceListItem components. This allo...

amundsen-frontend (>=1.0.1, <=2.3.0), amundsen-metadata (>=1.0.17, <=3.5.0) +10 more potentially affected by CVE-2025-71176 via pytest (3.5.1)

pytest PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - amundsen-frontend =1.0.1, =1.0.17, =2.4.1, =0.1.4, =0.1.3, =1.2.0, =1.10.0, =0.2.7, =1.2.0, =0.1.0, =0.1.2 Source cves: CVE-2025-71176 Source...

a16z (0.0.1), aibuilder (>=0.0.53, <=0.0.54) +64 more potentially affected by CVE-2025-71176 via pytest (6.1.2)

pytest PYPI version 6.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - a16z 0.0.1 - aibuilder =0.0.53, =3.0.0, =0.0.27, =0.0.0a1, =0.0.0rc211121071746, =1.0.0, =0.0.2, =1.0.1, =1.0.3 and more Source cves: CVE-2025-71176...

amundsen-frontend (>=3.4.0, <=3.7.0), arize (>=2.1.8, <=2.1.11) +37 more potentially affected by CVE-2025-71176 via pytest (6.2.2)

pytest PYPI version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - amundsen-frontend =3.4.0, =2.1.8, =0.0.2, =0.7.7, =1.0.0, =0.1.6.1, =1.6.0, =0.0.3, =1.0.0, =0.8.3.dev16, =1.12.0, =0.1.1, =0.1.4 and more Source...

amundsen-frontend (>=1.0.1, <=2.3.0), amundsen-metadata (>=1.0.17, <=3.5.0) +10 more potentially affected by CVE-2025-71176 via pytest (3.5.1)

pytest PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - amundsen-frontend =1.0.1, =1.0.17, =2.4.1, =0.1.4, =0.1.3, =1.2.0, =1.10.0, =0.2.7, =1.2.0, =0.1.0, =0.1.2 Source cves: CVE-2025-71176 Source...

altair-images (>=0.1.0, <=0.1.4), amundsen-common (>=0.14.0, <=0.15.3) +69 more potentially affected by CVE-2024-6221 via flask-cors (3.0.8)

flask-cors PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - altair-images =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =0.11.0, =0.9.0, =0.1.0, =0.2.2 and more Source cves:...

Privilege Escalation

amundsen-frontend is vulnerable to privilege escaltion. Any user is allowed to change table and column descriptions because the properties UNEDITABLESCHEMAS and/or UNEDITABLETABLEDESCRIPTIONMATCHRULES set in the front-end are not enforced...

GHSA-47QG-Q58V-7VRP UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend

Impact Any install that has UNEDITABLESCHEMAS and/or UNEDITABLETABLEDESCRIPTIONMATCHRULES set in the front-end, is being impacted. The value of these properties is ignored if set, allowing any user to modify table and column descriptions, even though the properties imply they shouldn't be. Patche...

aeropress (0.0.5), allennlp-datalawyer (>=0.1.0, <=0.1.10) +33 more potentially affected by CVE-2019-19275 via typed-ast (>=1.0.4, <=1.3.1)

typed-ast PYPI version =1.0.4, =0.1.0, =1.0.1, =1.0.17, =2.4.1, =0.1.1, =1.0.0, =2.2.2b1, =0.31.0, =1.3.5, =1.0.0b0, =0.3.4, =0.9.94, =2.0.3 - hmt-escrow 0.2.0rc1 and more Source cves: CVE-2019-19275 Source advisory: OSV:PYSEC-2019-131...