---
id: CVE-2026-90772
title: >-
  Amundsen frontend through 4.3.0 renders table, dashboard, and feature
  descriptions with dangerouslySetInnerHTML without HTML sanitization in
  ResourceListItem components
summary: >-
  Amundsen frontend through 4.3.0 renders table, dashboard, and feature
  descriptions with dangerouslySetInnerHTML without HTML sanitization in
  ResourceListItem components. Attackers can inject malicious markup like img
  elements with onerro…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-79
vendor: amundsen-io
product: amundsen-frontend
affected:
  - amundsen-frontend <= 4.3.0
published: '2026-09-13'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T18:20:25.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90772'
references:
  - url: 'https://github.com/amundsen-io/amundsen'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/amundsen-io/amundsen/blob/frontend-4.3.0/frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx
    label: disclosure@vulncheck.com
  - url: 'https://github.com/amundsen-io/amundsen/issues/2362'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/amundsen-frontend-through-4.3.0-stored-xss-via-description
    label: disclosure@vulncheck.com
  - url: 'https://github.com/amundsen-io/amundsen/issues/2362'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T17:31:29.641707Z'
epss: 0.00209
epssPercentile: 0.11331
ingestedAt: '2026-09-14T15:23:07.471Z'
---

## Overview

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.