CVE-2026-84942

Awaiting Analysis Awaiting Analysis - Queue

Improper Input Validation in OpenSearch Dashboards Allows JavaScript Execution

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: AMZN

Description

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84942

Affected Vendors & Products

Vendor	Product	Version / Range
opensearch	dashboards	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards. It allows a remote authenticated attacker with dashboard write permissions to inject and execute arbitrary JavaScript in the browser sessions of other users by saving a specially crafted Vega visualization. The issue occurs because the validation routine failed to properly check function properties nested inside arrays, allowing them to bypass security controls.

Impact Analysis

An attacker could perform unauthorized actions on behalf of affected users, such as accessing sensitive data, modifying settings, or performing administrative tasks. Users with dashboard write permissions can exploit this to target other users, including those with higher privileges, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, potential fines, and reputational damage if exploited.

Mitigation Strategies

Restrict write access to the visualization and saved-object APIs to trusted users only. Optionally disable the Vega visualization type. Upgrade to OpenSearch Dashboards v2.19.5 or v3.6.0, or update Amazon OpenSearch Service domains to the latest service software version.

Hi! I’m here to help you understand CVE-2026-84942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70