High severity7.6NVD Advisory· Published Sep 13, 2026

CVE-2026-90772

Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

Affected products

Amundsen Io/Amundsenreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=4.3.0

Patches

Vulnerability mechanics

References

github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsxnvd
github.com/amundsen-io/amundsen/issues/2362nvd
www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-descriptionnvd

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000