CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Source AWS Security Bulletins
Not known to be exploited.
Data as of 10/25/2026, 08:10:09 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 44% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Description
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
Impact
Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected OpenSearch Dashboards, potentially leading to session hijacking or other client-side attacks. However, no active exploitation has been reported.
Summary
This vulnerability, identified as CVE-2026-84942, involves a stored XSS issue in OpenSearch Dashboards where the Vega expression function can be bypassed to inject malicious scripts. The input is stored and executed when viewed, potentially leading to script execution in the context of the affected application. No technical details or affected versions are specified in the provided data.