CVE-2018-1000086: Cross Site Request Forgery (CSRF) vulnerability in pym.js
Summary
CVE-2018-1000086: pym.js CSRF Vulnerability. Affects pym.js versions >= 0.4.2, < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pym.js is an open-source JavaScript library developed by the NPR Visuals Team. It is used for embedding responsive iframes on web pages. The library allows developers to create and manage iframes that can communicate with their parent page. Pym.js versions 0.4.2 up to 1.3.1 are affected by a high severity Cross Site Request Forgery (CSRF) vulnerability.
Vulnerability Detail
The vulnerability exists in the Pym.js _onNavigateToMessage function, specifically in the code located at line 573 of the pym.js file. This vulnerability allows an attacker to execute arbitrary JavaScript code. By crafting a malicious page, an attacker can gain full JavaScript access to pages that have Pym.js embeds when a user visits the attacker's page. This can lead to various security risks and potential unauthorized actions on the affected pages.
How To Fix
Latest published version: 1.3.2 as of 23 Oct 2026
npm install pym.js@1.3.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the pym.js package to the fixed version.
Conclusion
The Cross Site Request Forgery (CSRF) vulnerability in pym.js versions 0.4.2 up to 1.3.1 allows an attacker to execute arbitrary JavaScript code on pages with Pym.js embeds. It is crucial to update the pym.js package to version 1.3.2 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pym.js →
FAQ
pym.js is an open-source JavaScript library developed by the NPR Visuals Team. It is used for embedding responsive iframes on web pages.
Versions 0.4.2 up to 1.3.1 of pym.js are affected by this vulnerability.
The vulnerability allows an attacker to execute arbitrary JavaScript code on pages with Pym.js embeds, potentially leading to unauthorized actions and security risks.
Yes, the vulnerability has been fixed in pym.js versions 1.3.2 and later.
To fix the vulnerability, update the pym.js package to version 1.3.2 or later.
