Executive brief
OpenSearch Dashboards is a visualization and analytics platform that allows users to create interactive dashboards from data. A stored cross-site scripting (XSS) vulnerability in the Vega visualization component allows authenticated users with dashboard editing permissions to inject malicious code that executes in other users' browsers when they view the affected dashboard, potentially leading to account compromise or unauthorized access to sensitive analytics data.
Technical details
The vulnerability is a stored XSS flaw in how OpenSearch Dashboards processes Vega expression functions, enabling bypass of input sanitization controls. An authenticated attacker with dashboard write permissions can craft a malicious Vega visualization specification containing JavaScript code that gets stored in the dashboard configuration. When other users view the dashboard, the injected script executes in their browser context with their privileges, potentially enabling session hijacking, credential theft, or further unauthorized access. The attack requires prior authentication and dashboard modification capabilities but no user interaction beyond normal dashboard viewing. Patches are available in OpenSearch Dashboards v2.19.5 and v3.6.0 for self-managed deployments, and AWS-managed OpenSearch Service updates are available for all affected versions.
Affected products
- OpenSearch Project OpenSearch Dashboards v2.0.0 through v2.19.4; v3.0.0 through v3.5.0; fixed in v2.19.5 and v3.6.0
- Amazon OpenSearch Service v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0
Timeline
- 2026-09-09: disclosed: AWS Security Bulletin 2026-102-AWS published
- 2026-09-09: patched: Patches released for OpenSearch Dashboards v2.19.5 and v3.6.0; AWS-managed versions patched