Attributed metadata history
Up to 100 retained publisher events per page for 42302cc3253eb68ae27d246716739d827dd3ebfb68024da83d2986093af856a8. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
available
Fingerprint: 596c214e60f67af37a9e8175e4f5cd1a8ccaa6da5d5c0b2911f426d14b9208a6
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
Bulletin ID: 2026-102-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/08/2026 12:30 PM PDT Description: A stored cross-site scripting (XSS) issue in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. Affedted products & versions: OpenSearch Dashboards (open-source, self-managed): - Affected: v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, v.2.6.0, v2.7.0, v2.8.0, v2.9.0, v2.10.0, v2.11.0, v2.12.0, v2.13.0, v2.14.0, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v3.0.0, v3.1.0, v3.2.0, v3.3.0, v3.4.0, v3.5.0 - Fixed: v2.19.5 and v3.6.0 Amazon OpenSearch Service (AWS Managed): - Affected: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0 - Fixed: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0 and v3.1.0, v3.3.0, v3.5.0 Amazon OpenSearch Serverless: - Not affected Please refer to the article below for the most up-to-date and complete information
Fingerprint: 1af9b494768e1d59dbffa2c548e0ccf7b2c54f32d3753766c1dac2ac64346583