Executive brief
Amundsen frontend is a metadata-driven tool that data analysts and engineers use to discover and understand data assets. The application unsafely renders table, dashboard, and feature descriptions from external sources without sanitizing HTML, allowing attackers to inject malicious scripts that execute in every user's browser when viewing search results, potentially stealing credentials or session tokens.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the ResourceListItem React components (TableListItem, DashboardListItem, FeatureListItem). The vulnerable code uses React's dangerouslySetInnerHTML to render descriptions fetched from the metadata service or Elasticsearch without any HTML sanitization. Attackers can inject malicious markup such as img elements with onerror event handlers into descriptions, which will be executed in the browser of every user viewing the search results. No authentication is required to inject payloads if the attacker has access to the backend metadata service or Elasticsearch instance. The vulnerability affects Amundsen frontend through version 4.3.0; the project was archived on September 10, 2026, and no patch is expected.
Affected products
- Amundsen Amundsen Frontend through 4.3.0
Timeline
- 2026-09-13: disclosed
- 2026-09-10: other: Project archived on GitHub, read-only status