CVE-2017-1000042: Content Injection via TileJSON attribute in mapbox.js
Summary
CVE-2017-1000042: Content Injection via TileJSON attribute in mapbox.js. Affects mapbox.js across 2 version ranges.
< 1.6.5
>= 2.0.0, < 2.1.7
Fixed in 1.6.5 or 2.1.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mapbox.js is an open-source JavaScript library that provides a set of tools for creating interactive maps on the web. It allows developers to integrate maps and geospatial functionality into their applications. However, versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are vulnerable to a content injection vulnerability via the TileJSON attribute. This vulnerability can be exploited in certain uncommon usage scenarios, allowing a malicious user to inject script content into the 'attribution' value of the TileJSON, which will be executed in the context of the page using Mapbox.js.
Vulnerability Detail
The content injection vulnerability in mapbox.js arises when untrusted TileJSON content from a non-Mapbox URL is loaded using the 'L.mapbox.map' or 'L.mapbox.tileLayer' functions. An attacker with control over the TileJSON content can manipulate the 'attribution' value to inject malicious script content. When the map is rendered, the injected script will be executed in the context of the page, potentially leading to cross-site scripting (XSS) attacks. This vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 3.3.1 as of 23 Oct 2026
npm install mapbox.js@3.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.51.6.5npm install mapbox.js@1.6.5 -
>= 2.0.0, < 2.1.72.1.7npm install mapbox.js@2.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update to the patched versions of mapbox.js to ensure the security of the application.
Conclusion
In conclusion, the content injection vulnerability in mapbox.js can be exploited by a malicious user to inject script content into the 'attribution' value of the TileJSON, potentially leading to cross-site scripting attacks. It is crucial to update to the latest patched versions of mapbox.js to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mapbox.js →
FAQ
mapbox.js is an open-source JavaScript library that provides tools for creating interactive maps on the web.
Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are affected.
The vulnerability allows an attacker to inject malicious script content into the 'attribution' value of the TileJSON, potentially leading to cross-site scripting (XSS) attacks.
To fix this vulnerability, update to the latest version of mapbox.js (2.1.7 or later for version 2.x, and 1.6.5 or later for version 1.x).
No specific workaround is available. Updating to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for mapbox.js.
