AWSAWS-2026-167

Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

CVE-2026-121652 · Published Nov 3, 2026

Medium5.4

No fix yet

Bulletin ID: 2026-167-AWS Publication Date: 11/03/2026 10:30 AM PST Description: maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Impacted versions: <= 4.0.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityNov 4Severity: Unrated to Medium

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from: NVD

More AWS advisories

All AWS

High 7.8Nov 3

AWS API MCP Server OAuth token audience validation bypassCVE-2026-115413no fix yet High 8.1Nov 3

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection...CVE-2026-119084no fix yet High 8.8Nov 3

Babelfish for PostgreSQL Privilege EscalationCVE-2026-119922no fix yet Medium 6.5Nov 2

Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yet Medium 6.1Nov 2

Improper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yet Medium 5.0Nov 2

Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yet