Description

Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-21T21:17:08.903Z",
  "pubdate": "2026-08-21T21:17:08.903Z",
  "executiveSummary": "An improper input validation vulnerability has been identified in the dashboards-observability plugin within OpenSearch Dashboards. This security flaw enables a remote, authenticated user possessing write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript within the browser sessions of other users. The mechanism of exploitation relies on uploading a malicious saved asset containing arbitrary web content, which is subsequently rendered in the context of victim browser sessions. The potential impact includes unauthorized script execution, session hijacking, data exfiltration, and manipulation of the dashboard interface. Successful exploitation requires prior authentication, specifically write access to saved objects, and remote network access to the OpenSearch Dashboards instance. The risk implication is significant as it compromises the integrity and confidentiality of user sessions interacting with the affected observability plugin.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper sanitization mechanisms within the dashboards-observability plugin of OpenSearch Dashboards. Specifically, the component fails to adequately validate and sanitize user-supplied data embedded within saved assets prior to persistent storage and subsequent rendering. This permits an attacker with write permissions to inject malicious payloads containing arbitrary web content, specifically executable JavaScript, into OpenSearch Dashboards saved objects.\nThe exploitation lifecycle begins with an authenticated attacker acquiring or leveraging existing write permissions to the OpenSearch Dashboards saved objects repository. The attacker crafts a malicious saved asset incorporating arbitrary JavaScript payloads within the web content fields processed by the dashboards-observability plugin. Upon uploading or saving this crafted asset, the malicious payload is persistently stored in the underlying data store.\nThe attack vector is triggered when a victim user navigates to or loads the affected observability dashboard containing the malicious asset. OpenSearch Dashboards retrieves the saved object and renders its contents within the victim's browser context without proper escaping or sanitization. Consequently, the injected JavaScript executes automatically within the session of the victim user. Because the script executes in the context of the victim's browser session, it inherits the victim's permissions and access tokens, allowing the attacker to perform actions on behalf of the victim, access sensitive data exposed via the interface, or interact maliciously with the underlying OpenSearch Dashboards APIs."
}