Amundsen frontend versions up to 4.3.0 improperly neutralize input during web page generation by rendering table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. This allows attackers to inject malicious markup such as img elements with onerror handlers via the metadata service or Elasticsearch, resulting in cross-site scripting that executes JavaScript in every user's browser who views the affected search results.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of users' browsers when they view search results containing maliciously crafted descriptions. This can lead to session hijacking, credential theft, or other malicious actions within the user's browser session. The vulnerability affects all users who access the vulnerable frontend versions and view injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing untrusted metadata or Elasticsearch content to the frontend or implement manual HTML sanitization before rendering. Monitor vendor channels for official patches or updates addressing this vulnerability.