This vulnerability (CVE-2026-84942) involves improper neutralization of input during web page generation (CWE-79) in the Vega expression function of OpenSearch Dashboards. An authenticated actor with write permissions can store malicious JavaScript in a Vega visualization, which executes in the context of other users' browsers when they view the dashboard. Affected open-source OpenSearch Dashboards versions include 2.0.0 through 2.19.0 and 3.0.0 through 3.5.0, with fixes starting at 2.19.5 and 3.6.0. The AWS managed Amazon OpenSearch Service versions listed as affected have been fixed in the same or earlier versions. Amazon OpenSearch Serverless is not affected. AWS manages patching for the cloud service.

Successful exploitation allows an authenticated user with dashboard write permissions to execute arbitrary JavaScript in other users' browser sessions, potentially leading to credential theft, session hijacking, or other client-side attacks. The CVSS v3.1 score is 8.7 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity. Availability is not impacted.

AWS has released official fixes for affected OpenSearch Dashboards versions starting at 2.19.5 and 3.6.0. For the AWS managed Amazon OpenSearch Service, the vendor manages remediation and has applied fixes to all affected versions listed. Users of self-managed OpenSearch Dashboards should upgrade to fixed versions promptly. For the cloud service, no user action is required as AWS handles patching. Refer to the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-102-aws/ for the latest guidance.