CVE-2026-84942: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in AWS Amazon OpenSearch Service
Description
CVE-2026-84942 is a high-severity cross-site scripting (XSS) vulnerability in AWS Amazon OpenSearch Service affecting the Vega expression function in OpenSearch Dashboards. It allows a remote authenticated user with dashboard write permissions to execute arbitrary JavaScript in other users' browsers by saving a crafted Vega visualization. The vulnerability is due to improper input validation that fails to inspect nested arrays, enabling malicious function properties to bypass checks. This can lead to full compromise of user sessions without affecting service availability. A patch is available, and AWS manages remediation for this cloud service.
CVSS v3.1
Score 8.7high
Affected software
AWS
Amazon OpenSearch Service
OpenSearch
OpenSearch Dashboards
pkg:github/opensearch-project/OpenSearch-DashboardsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84942 is a cross-site scripting vulnerability in the Vega expression function implementation within OpenSearch Dashboards of AWS Amazon OpenSearch Service. The flaw arises because the input validation routine does not properly inspect nested arrays, allowing malicious function properties to bypass validation. An authenticated user with dashboard write permissions can exploit this by saving a specially crafted Vega visualization, which executes arbitrary JavaScript in other users' browsers when viewed. This vulnerability can lead to complete compromise of user sessions. The vulnerability affects versions >=2.0.0 <=3.5.0, >=2.0.0 <2.19.5, and >=3.0.0 <3.6.0. AWS provides a patch and manages remediation for this cloud-hosted service.
Potential Impact
An authenticated user with dashboard write permissions can execute arbitrary JavaScript in other users' browsers, potentially leading to full compromise of user sessions. The vulnerability does not impact availability but poses a significant confidentiality and integrity risk.
Mitigation Recommendations
A patch is available for this vulnerability. Since Amazon OpenSearch Service is a cloud-hosted service, AWS manages remediation server-side. Users should consult the AWS security advisory at https://aws.amazon.com/security/security-bulletins/2026-102-aws/ for current remediation status and ensure their service is updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-09-02T16:47:56.353Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-102-aws/","vendor":"AWS"}]
Threat ID: 6aa0678dacd9273b49254de6
Added to database: 09/08/2026, 19:52:45 UTC
Last enriched: 10/23/2026, 18:32:20 UTC
Last updated: 10/23/2026, 23:51:09 UTC
Views: 130
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.