CVE-2026-84942
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Risk Assessment
Risk of session hijacking, data theft, or unauthorized actions in the context of other users' privileges, potentially leading to confidentiality and integrity breaches.
Recommendation
Update OpenSearch Dashboards to a patched version and restrict dashboard write permissions to trusted users only.
Other vulnerabilities in OpenSearch Dashboards
See all- CVE-2026-77811High
The dashboards-observability plugin in OpenSearch Dashboards has an improper input validation vulnerability. A remote authenticated user with write permissions to saved objects can execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
- CVE-2026-18420High
The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.
- CVE-2026-75897High
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
Original NVD description (English source)
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS