What is 2026-167-AWS?

2026-167-AWS is a security advisory published by AWS Security Bulletins. CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Which CVE IDs does 2026-167-AWS cover?

2026-167-AWS covers the following CVE IDs: CVE-2026-121652. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-167-AWS

CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Vendor

AWS Security Bulletins

Published

November 3, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-121652 →

📋 Description

Bulletin ID: 2026-167-AWS Publication Date: 11/03/2026 10:30 AM PST Description: maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Impacted versions:
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-167-aws/