CVE-2026-66155: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens Element maps-ng V47

This vulnerability affects Siemens Element maps-ng versions before V47.12.3, V48.11.3, and V49.16.1. The si-map component does not properly sanitize the points property input used in tooltip labels for map pins, leading to a cross-site scripting (CWE-79) flaw. Exploitation requires a victim to load a crafted URL and hover over a map pin, causing arbitrary script execution within the victim's browser session. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required privileges and user interaction, and high confidentiality impact with limited integrity impact.

Successful exploitation allows an attacker to execute arbitrary script code in the context of the victim's browser session. This can lead to theft of sensitive information or session hijacking. The vulnerability does not impact availability. The attack requires the victim to load a malicious URL and interact by hovering over a map pin tooltip.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. No official fix or temporary workaround is stated in the provided data. Until a patch is available, avoid loading untrusted URLs containing map pins or disable tooltip display if possible.