CVE-2026-121652 – Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Bulletin ID: 2026-167-AWS
Publication Date: 11/03/2026 10:30 AM PST

Description:

maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering.

Impacted versions: <= 4.0.2

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Read the original article:

CVE-2026-121652 – Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering