Unvalidated HTML Rendering Enables XSS in Amundsen Frontend

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90772 is a stored cross-site scripting (XSS) vulnerability in Amundsen's frontend components that fail to sanitize HTML content before rendering descriptions for tables, dashboards, and features. By exploiting the dangerouslySetInnerHTML pattern without input validation, attackers can inject malicious markup—such as img elements with onerror event handlers—through data sources like the metadata service or Elasticsearch. Every user who views search results containing the poisoned descriptions will execute the attacker's JavaScript in their browser session, potentially leading to credential theft, session hijacking, lateral movement, or deployment of secondary payloads. Organizations running Amundsen 4.3.0 and earlier are affected, particularly those with untrusted or insufficiently protected backend data sources.

Casky's 323 matched skills help practitioners identify the attack patterns mapped to MITRE TA0001 (Initial Access) and TA0043 (Reconnaissance) by leveraging Claude's extended reasoning to correlate indicators across the ATT&CK framework. Practitioners will see detection findings that highlight suspicious metadata injection patterns, abnormal JavaScript execution contexts in resource rendering workflows, and anomalous data flow from backend services into DOM elements. Casky's skills enable teams to trace how attacker-controlled content moves through Amundsen's data pipeline, recognize the absence of Content Security Policy (CSP) or HTML sanitization controls, and implement compensating detections for stored XSS payload activation—surfacing the gap between data ingestion and secure frontend rendering before widespread compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90772.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-90772

Casky has 323 skills that investigate the attack patterns behind CVE-2026-90772. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn