CVE-2026-121652 in maplibre-gl-js-amplify
Summary
by MITRE • 11/03/2026
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a cross-site scripting flaw within AWS Amplify's maplibre-gl-js-amplify library prior to version 4.0.3 represents a significant security risk for applications utilizing geospatial data visualization features. This specific implementation of the MapLibre GL JS mapping engine, when integrated with the AWS Amplify framework, fails to adequately sanitize user-supplied input before rendering it in interactive map components. The core technical flaw lies in the insufficient validation and encoding mechanisms applied to properties within GeoJSON feature data that are subsequently rendered by the popupRender function or displayed via the AmplifyGeofenceControl component. Because these components directly inject content into the DOM without proper context-aware escaping, they create a vector for stored or reflected cross-site scripting attacks depending on how the underlying geospatial data is sourced and persisted within the application's backend systems.
The operational impact of this vulnerability allows remote authenticated users to execute arbitrary JavaScript code in the context of the victim's browser session. The attack surface encompasses three specific properties within GeoJSON feature data: title, address, and place_name. If an attacker can control or influence any of these fields when creating or modifying map features, they can inject malicious scripts that will be executed whenever a user interacts with the corresponding map marker or popup. Additionally, the geofenceId value rendered by AmplifyGeofenceControl serves as another injection point for similar attacks. The consequences of successful exploitation are severe and multifaceted. Attackers can steal sensitive session cookies, authentication tokens, or other credentials stored in browser storage, leading to account takeover. They can also perform actions on behalf of the victim, such as modifying data, making unauthorized requests to internal services, or defacing the application interface by injecting malicious HTML content that alters the visual presentation and user experience for all affected users.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the failure to neutralize special elements within input data before including them in output used by web browsers. In terms of offensive security tactics, this flaw facilitates techniques associated with MITRE ATT&CK T1059, specifically Command and Scripting Interpreter execution via browser-based scripts like JavaScript or VBScript. It also relates to T1203, Software Execution, where the attacker leverages trusted software components to execute malicious code within a legitimate process context. The presence of this vulnerability in geospatial libraries is particularly concerning because map interfaces are often central to business logic and user interaction, making them high-value targets for persistent access or data exfiltration campaigns.
To mitigate this risk, organizations must prioritize the immediate upgrade of their AWS Amplify dependencies to version 4.0.3 or any later release where these sanitization issues have been addressed by the maintainers. Beyond upgrading libraries, developers should implement defense-in-depth strategies such as Content Security Policy headers that restrict script execution sources and prevent inline scripts from running unless explicitly allowed through nonces or hashes. Input validation at the application layer is also critical; while client-side rendering requires robust library fixes, server-side validation of all GeoJSON properties before storage ensures that even if a new vulnerability emerges in future versions, malicious payloads are rejected before they can be persisted and subsequently rendered to other users. Regular security audits and dependency scanning tools should be employed to monitor for similar vulnerabilities in related mapping or geospatial libraries used within the application stack.