Pannellum has a XSS vulnerability in hot spot attributes

Description

The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter).

Recommendation

Update the pannellum package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.5.0, < 2.5.7
• Patched version(s): 2.5.7

References

• GHSA-8423-w5wx-h2r6
• CVE-2026-27210
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Trix has a Stored XSS vulnerability through serialized attributes - CVE-2026-73426
• NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
• i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

pannellum