Improper Input Validation in OpenSearch Dashboards by OpenSearch

CVE-2026-84942

What is CVE-2026-84942?

A vulnerability exists in OpenSearch Dashboards due to improper input validation associated with the Vega expression function implementation. This flaw enables an attacker with dashboard write permissions to execute arbitrary JavaScript in the browser sessions of other users. Specifically, the validation process does not effectively recurse into arrays of objects, allowing attackers to insert function properties into a crafted Vega visualization that can bypass validation checks. As a result, this ability leads to potential remote code execution risks within user sessions.

References