CVE-2026-9029

What it actually does

A stored cross-site scripting flaw in the geomap panel XYZ tile layer sanitizes the raw template string before variable interpolation. After substitution (glob format, no HTML escaping), the result is written into the DOM via innerHTML, so a crafted textbox variable default is treated as markup/script in the victim browser. This bypasses the earlier sanitization fix associated with CVE-2023-0507. An authenticated Editor can persist the payload in a dashboard so it runs in the origin of every user who opens that dashboard, enabling session/token theft and in-origin actions as the victim. Confidentiality and integrity impact is high; availability is not directly affected.

Why it matters to the business

Anyone who can edit dashboards can plant a trap that silently hijacks the browsers of viewers and admins who open a shared map view—risking account takeover, data exfiltration, and unauthorized changes made in a trusted user’s name. The issue is not on CISA KEV, exploit maturity is none, and EPSS remains low (~0.003) though it rose about 26% over 30 days; it has been public for roughly 99 days, so unpatched shared dashboards stay a lingering insider and supply-path risk rather than a mass internet worm. Downstream operational impact is highest where Editors are broadly granted and dashboards are used as a daily control plane.

How an attack unfolds

An attacker who already has Editor (or equivalent) access creates or edits a dashboard that includes a geomap XYZ tile layer bound to a textbox template variable. They place attacker-controlled markup in that variable’s default (or similarly persisted) value. Sanitization runs on the unsubstituted template, so the later glob-style replace injects the raw value into OpenLayers via innerHTML. When any other user opens the dashboard, their browser executes the injected script in the application origin, allowing the attacker to abuse the victim’s session. No public weaponization or named threat-actor use is indicated.

How to fix it

Apply the vendor patch for this issue as soon as a fixed build is available for your release train; no specific fixed versions were supplied with this record, so confirm the advisory for your edition before upgrading. Until patched, restrict who may create or edit dashboards and geomap/XYZ layers, review existing dashboards for textbox variables feeding tile URLs or related geomap fields, disable or remove untrusted geomap XYZ usage, and enforce a strict Content-Security-Policy that blocks inline script where the product allows it. Treat this as a bypass of the CVE-2023-0507 sanitization fix—do not rely on that earlier patch alone.

How to confirm the fix worked

After upgrade, in a non-production instance with a disposable Editor account, confirm that geomap XYZ layers still interpolate variables but that stored textbox values cannot introduce markup into the tile layer DOM (no innerHTML execution of interpolated content). Inventory dashboards for geomap panels, XYZ tile templates, and textbox variables; flag any that interpolate into tile/layer fields. Verify CSP and role bindings in configuration, and re-read the vendor advisory to match your exact package and build.

Typical attack path

1. Obtain or reuse an account with dashboard Editor (or stronger) privileges
2. Create or modify a dashboard that uses the geomap panel XYZ tile layer with a textbox template variable
3. Persist attacker-controlled content in the variable default or equivalent stored field so interpolation occurs after sanitization
4. Share or leave the dashboard where intended victims will open it
5. Victim opens the dashboard; interpolated content is assigned to innerHTML and runs in their session
6. Attacker uses the victim’s origin session to steal credentials/tokens or perform in-app actions

How to detect it

This is stored XSS, so look for persistence and victim rendering rather than a network exploit kit. Review dashboard revision history and exported dashboard JSON for geomap panels with XYZ tile layers whose templates or textbox variable defaults contain markup, event-handler attributes, or javascript: URLs. On the application and reverse-proxy side, look for Editor users saving dashboards followed by many distinct viewers loading the same dashboard UID. In browser RUM, EDR, or CSP reports, watch for script execution or innerHTML mutations originating from geomap/OpenLayers tile elements on dashboard pages. There is no public KEV or named-actor playbook; treat unexpected dashboard edits by low-privilege Editors as the primary lead. Correlate with session reuse, API calls as the victim after they only viewed a dashboard, and CSP violation reports on dashboard routes.

• dashboard JSON panel type geomap with XYZ tile layer templates containing ${ or [[ variable interpolation
• textbox variable default values containing <script, onerror=, onload=, javascript:, or srcdoc=
• OpenLayers tile/layer nodes populated via innerHTML on dashboard view
• CSP violation reports on dashboard or geomap routes citing inline script or unsafe innerHTML
• audit/save events for dashboard updates by Editor-role users shortly before mass panel-view traffic

What your security team should do

• Patch or upgrade all instances once the vendor fixed build for your branch is identified; do not assume the CVE-2023-0507 fix is sufficient
• Immediately reduce Editor-level dashboard permissions to a need-to-have set and review shared geomap dashboards
• Hunt historical dashboard JSON and variable defaults for geomap XYZ templates that interpolate unsanitized textbox values
• Enable or tighten Content-Security-Policy and session protections (short-lived cookies, HttpOnly, clickjacking controls) to limit XSS blast radius
• Track EPSS and exploit-maturity; re-prioritize if public PoCs or KEV listing appear