AmazonAnalysisAWS patches stored cross-site scripting flaw in Amplify MapLibre library
What happened.Amazon Web Services published security bulletin 2026-167-AWS detailing a stored cross-site scripting vulnerability within the open-source AWS Amplify MapLibre location library.
Why it matters.Frontend mapping libraries frequently handle location telemetry and boundary data without secondary sanitization. When applications render user-supplied coordinates and metadata directly into browser sessions, attackers can harvest session tokens and compromise administrative dashboards. Software builders using AWS Amplify location components should upgrade dependencies to version 4.0.3 immediately. Application security engineers should audit custom popup templates to ensure HTML escaping covers all dynamic user attributes.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-121652, the maplibre-gl-js-amplify package interpolated user-supplied GeoJSON properties directly into application DOM elements using unescaped innerHTML calls.
- Exploitation vector: An authenticated attacker storing malicious JavaScript within map point titles, address strings, or geofence markers could trigger script execution in victim browser sessions.
- Remediation release: AWS issued version 4.0.3 of the package to introduce mandatory HTML encoding utilities across all map popup and location display handlers.