high7.1
CVE-2022-0177
Cross site scripting in three.js
Impact
# CVE has been withdrawn Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | three | < 0.137.0 | 0.137.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-7vvq-7r29-5vg3
- https://nvd.nist.gov/vuln/detail/CVE-2022-0177
- https://github.com/mrdoob/three.js/commit/0c31bc605e21965aad8a6479bb1969351773f76d
- https://huntr.dev/bounties/16901080-99b4-4fb5-8c5b-931bfbf33cba
- https://github.com/mrdoob/three.js/pull/23245