CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering Bulletin ID: 2026-167-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/03/2026 10:30 AM PST Description: maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing controls in web applications. We identified CVE-2026-121652, where a stored cross-site scripting (XSS) issue in the library's popup and geofence-control rendering. Several code paths interpolated user-controlled GeoJSON feature properties (title, address, and place_name) and geofence identifiers directly into the DOM via innerHTML without sanitization. An actor who stored a crafted…