CVE-2026-66155
Received Received - Intake

Cross-Site Scripting in Element maps-ng

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: siemens-SADP

Description
A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-66155
EUVD
EUVD-2026-67006

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
siemens element_maps-ng to 47.12.3 (exc)
siemens element_maps-ng to 48.11.3 (exc)
siemens element_maps-ng to 49.16.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Siemens Element Maps component. The si-map component fails to properly neutralize user input in the points property used for tooltip labels on map pins. An attacker can craft a malicious URL that executes arbitrary script code in a victim's browser when they hover over a map pin.

Detection Guidance

To detect this vulnerability, check if your system uses the affected versions of @siemens/maps-ng (V47 < V47.12.3, V48 < V48.11.3, V49 < V49.16.1). Inspect network traffic for suspicious URLs or payloads in tooltip interactions. Enable logging for the si-map component and monitor for unusual script execution.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. This could lead to unauthorized access to sensitive data or account compromise if you interact with the affected map component.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Immediately update to the latest patched versions: V47.12.3 or later for V47, V48.11.3 or later for V48, and V49.16.1 or later for V49. Additionally, enable Trusted Types enforcement, follow Angular security best practices, and deploy a strict Content Security Policy (CSP). Monitor access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart