OpenSearch Dashboards vulnerabilities

The dashboards-observability plugin in OpenSearch Dashboards has an improper input validation vulnerability. A remote authenticated user with write permissions to saved objects can execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.

The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.