Description

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-20T21:17:06.137Z",
  "pubdate": "2026-08-20T21:17:06.137Z",
  "executiveSummary": "An improper input validation vulnerability exists within the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards, classified as a prototype pollution flaw leading to remote code execution. This security deficiency allows an authenticated remote attacker to execute arbitrary code on the underlying server hosting OpenSearch Dashboards. The exploitation vector requires the attacker to possess authentication credentials in order to interact with the metrics visualization API endpoint. By submitting a specially crafted JSON payload designed to exploit prototype pollution mechanics within the TSVB plugin, the attacker can manipulate JavaScript object prototypes. This manipulation alters the execution flow of the application, ultimately yielding remote code execution capabilities within the server environment. The impact of successful exploitation is critical, as it compromises the confidentiality, integrity, and availability of the host system and potentially the broader cluster architecture. Remediation requires upgrading the affected deployment to the specified patched version to neutralize the underlying input validation weakness.",
  "technicalDetails": "The vulnerability resides within the Time Series Visual Builder (TSVB) plugin component of OpenSearch Dashboards, specifically exposed via its metrics visualization API endpoint. The root cause of the security flaw is improper input validation and unsafe object merging operations, which manifest as a prototype pollution vulnerability. JavaScript prototype pollution occurs when an attacker can modify the prototype of the base Object, injecting properties that are subsequently inherited by all objects in the application due to insecure recursive merging or property assignment routines.\nExploitation of this vulnerability requires the attacker to be authenticated within OpenSearch Dashboards and to possess network access to the metrics visualization API endpoint. The attack flow commences when the malicious user constructs a crafted JSON payload containing malicious property keys, such as __proto__ or constructor.prototype, designed to inject properties into the global Object prototype. Upon receipt of this payload, the vulnerable TSVB plugin processes and parses the JSON data insecurely, merging the attacker-supplied properties into application-level objects.\nBecause the metrics visualization API handles complex data configurations and rendering logic, the polluted prototype introduces malicious properties or overrides expected application behaviors within underlying libraries or execution contexts. Through careful crafting of the prototype pollution vector, the attacker manipulates internal configurations or execution paths that evaluate or process dynamic input, resulting in the execution of arbitrary operating system commands or code within the Node.js runtime environment hosting OpenSearch Dashboards.\nThe post-exploitation impact includes full system compromise at the privilege level of the OpenSearch Dashboards service user. Since the execution occurs on the server hosting the dashboard instance, the adversary may gain unauthorized access to underlying file systems, sensitive configuration data, stored credentials, and lateral movement vectors into connected clusters or network segments. Mitigating this risk requires eliminating the unsafe object modification paths within the vulnerable codebase."
}