Skip to content

Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript

Moderate severity GitHub Reviewed Published Nov 22, 2019 in mpetroff/pannellum • Updated Jan 11, 2023

Package

npm pannellum (npm)

Affected versions

>= 2.5.0, < 2.5.5

Patched versions

2.5.5

Description

Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser.

Recommendation

Upgrade to version 2.5.6 or later.

References

@mpetroff mpetroff published to mpetroff/pannellum Nov 22, 2019
Published to the GitHub Advisory Database Nov 22, 2019
Reviewed Jun 16, 2020
Last updated Jan 11, 2023

Severity

Moderate
4.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N

Weaknesses

CVE ID

CVE-2019-16763

GHSA ID

GHSA-m52x-29pq-w3vv

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.