A stored XSS flaw exists in AWS Amplify maplibre-gl-js-amplify through the popupRender function and the AmplifyGeofenceControl component. Data supplied by an authenticated user or external source – specifically the title, address, place_name fields of a GeoJSON feature or the geofenceId – is rendered without input validation, permitting the injection of arbitrary JavaScript or HTML. An attacker who can provide such data can then execute code in the context of any user viewing the map or geofence control, potentially leading to session hijacking, data theft, or defacement. The CVSS score of 4.8 indicates moderate severity, but the vulnerability can be exploited by remote authenticated users.

AWS Amplify maplibre-gl-js-amplify versions before 4.0.3 are affected. The vulnerability is present in the maplibre-gl-js-amplify JavaScript library when used in web applications that expose the popupRender or AmplifyGeofenceControl components to untrusted GeoJSON sources. Any deployment incorporating this library without applying the 4.0.3 release or newer is at risk.

The CVSS score of 4.8 reflects a moderate risk profile; however, no exploit is currently publicly documented and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed in the wild. The likely attack vector is authenticated but remote, requiring an attacker to supply malformed GeoJSON or geofence identifiers through an interface that accepts user data. Protection against exploitation hinges on input validation or library updates.