High severity · published Sep 13, 2026
CVE-2026-90772
Amundsen Frontend through 4.3.0 Stored XSS via Description
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
amundsen-frontend · amundsen-io
through 4.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90772
github.com
https://github.com/amundsen-io/amundsen
github.com
https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx
github.com
https://github.com/amundsen-io/amundsen/issues/2362
www.vulncheck.com
https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description