Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript

Description

Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim’s browser.

Recommendation

Update the pannellum package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.5.0, < 2.5.5
• Patched version(s): 2.5.5

References

• GHSA-m52x-29pq-w3vv
• www.npmjs.com
• CVE-2019-16763
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped - CVE-2020-28455
• AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes - CVE-2019-14863
• Cross-Site Scripting in fileview - CVE-2019-15602
• Cross-Site Scripting in seeftl - CVE-2019-15603

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

pannellum