Stored Cross-Site Scripting in Amundsen Frontend by Lyft
CVE-2026-90772

8.3HIGH

Key Information:

Vendor

Amundsen-io

Status
Amundsen-frontend
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90772?

The Amundsen Frontend application, versions up to 4.3.0, is susceptible to stored Cross-Site Scripting (XSS) due to improper handling of unsafe HTML content. The application utilizes dangerouslySetInnerHTML within ResourceListItem components to render feature descriptions, dashboards, and tables without adequate HTML sanitization. This vulnerability allows malicious actors to inject harmful markup, including JavaScript code with onerror handlers into descriptions, which can execute arbitrary JavaScript in the browsers of users viewing the affected data. Attackers can exploit this flaw via the metadata service or Elasticsearch, posing significant risks to the integrity and security of user sessions.

Affected Version(s)

amundsen-frontend 0 <= 4.3.0

References

https://github.com/amundsen-io/amundsen/issues/2362
issue-tracking
https://github.com/amundsen-io/amundsen
product
https://github.com/amundsen-io/amundsen/blob/frontend-4.3...
technical-description

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.