The dashboards‑observability plugin for OpenSearch Dashboards stores user‑supplied assets without proper input validation. An authenticated user who has write permissions to saved objects can upload an asset that contains arbitrary JavaScript. When other users load or view the asset, the script runs in their browser context, enabling attackers to steal session data, perform actions on behalf of the user, or lift privileges to other dashboards. The vulnerability is a stored XSS flaw, identified as CWE‑79, and allows the attacker to execute code in the victim’s browser.

The flaw affects the dashboards‑observability plugin bundled with Amazon OpenSearch Service and the OpenSearch Dashboards dashboards‑observability plugin. Specific versions impacted are not explicitly enumerated in the advisory; however, the references point to versions 2.19.6 and 3.4.0, indicating that the issue may exist in recent releases.

The CVSS score of 6.2 reflects a moderate impact that requires the attacker to be an authenticated user with write permissions. The EPSS score is unavailable, so the likelihood of exploitation cannot be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog. Attacks would involve creating or uploading a malicious asset as an authorized user and then convincing other users to view or load the asset. Because no server‑side code is executed, the risk is confined to the browser context, yet lateral actions are possible through stolen credentials or session hijacking.