The vulnerability is a prototype‑pollution flaw in the Time Series Visual Builder plugin of OpenSearch Dashboards. An authenticated remote user can send a crafted JSON payload to the metrics visualization API endpoint and cause arbitrary code to run on the server. This is a classic instance of insecure object handling (CWE‑1321) that directly leads to remote code execution.

The affected products are Amazon OpenSearch Service and OpenSearch Dashboards. Versions before 3.8 of OpenSearch Dashboards are vulnerable; the security advisory recommends upgrading to 3.8 or later to obtain the fix.

The CVSS score of 8.7 indicates a high severity and the vulnerability is exploitable by a remote authenticated user. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of public exploit data does not reduce the risk that an attacker could leverage the flaw. The primary attack vector is via the JSON API endpoint that processes visualization requests, so exposure is limited to authenticated users with access to the OpenSearch Dashboards API. The impact is full remote code execution on the server, enabling complete compromise of the affected cluster.