medium4.8
CVE-2019-16763
Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript
Impact
Versions of `pannellum` prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser. ## Recommendation Upgrade to version 2.5.6 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | pannellum | >= 2.5.0, < 2.5.5 | 2.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pannellum | Pannellum | from 2.5.0 through 2.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914
- https://github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vv
- https://github.com/advisories/GHSA-m52x-29pq-w3vv
- https://nvd.nist.gov/vuln/detail/CVE-2019-16763
- https://www.npmjs.com/advisories/1418