CVE-2026-90772

Amundsen frontend through version 4.3.0 renders table, dashboard, and feature descriptions using React's dangerouslySetInnerHTML without HTML sanitization in its ResourceListItem components, creating a stored cross-site scripting (XSS) flaw. An attacker with write access to descriptions via the metadata service or the Elasticsearch backend can plant malicious markup such as an img element with an onerror handler. The injected JavaScript then executes in the browser of every user who views the poisoned entry in search results or resource listings. Successful exploitation allows session hijacking, credential theft, and performing actions as the victim within the data catalog. No public proof of concept is known, and the vulnerability is not in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of exploitation in the wild.

What to do: Upgrade the Amundsen frontend to a release newer than 4.3.0 as soon as a patched version is available; no fixed version is identified in the advisory. In the interim, restrict who can write descriptions through the metadata service and Elasticsearch, audit existing descriptions for injected HTML (e.g., img tags with onerror attributes), and consider applying a Content-Security-Policy to the frontend to blunt script execution.