CVE-2023-1384 (published 2023-05-03T12:10:43.924Z)
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.
Insignia TV with FireOS versions prior to 7.6.3.3.
Affected products: Vendor: Amazon
Product: Fire TV Stick 3rd gen
Versions: 6.2.9.4