Package vulnerability, severity medium
AWS Amplify maplibre-gl-js-amplify stored XSS in popup and geofence rendering (CVE-2026-121652)
Published
A stored cross-site scripting flaw in maplibre-gl-js-amplify lets user-controlled GeoJSON properties and geofence identifiers be inserted into the DOM via innerHTML without sanitization. A crafted location record or geofence identifier can run script in another user's browser, enabling session hijacking or data exfiltration in the consuming application. Versions up to 4.0.2 are affected and 4.0.3 fixes it.
What's affected
- maplibre-gl-js-amplify (npm)<4.0.3
What to do
- Upgrade maplibre-gl-js-amplify to version 4.0.3 or later
- Patch any forked or derivative code to include the escapeHtml() fix
- If you cannot upgrade immediately, validate and sanitize location and geofence data (title, address, place_name, geofence identifiers) on input
- Apply a restrictive Content Security Policy to limit the impact of injected script
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident maplibre-gl-js-amplify-xss-2026-11References
Notice maplibre-gl-js-amplify-xss-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.