GHSA-m52x-29pq-w3vvMediumCVSS 4.8

Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript

Published
November 22, 2019
Last Modified
January 11, 2023

🔗 CVE IDs covered (1)

CVE-2019-16763 →

📋 Description

Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser.

Recommendation

Upgrade to version 2.5.6 or later.

🎯 Affected products1

  • npm/pannellum:>= 2.5.0, < 2.5.5

🔗 References (5)