CVE-2019-16763: Pannellum Cross-Site Scripting Vulnerability
Summary
CVE-2019-16763: Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript. Affects pannellum versions >= 2.5.0, < 2.5.5. Fixed in 2.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pannellum is an npm package that provides a web-based viewer for 360-degree panoramic images. It allows users to embed interactive panoramas into websites and applications. The package is widely used and provides a simple and intuitive way to display immersive images. However, versions prior to 2.5.6 are vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Pannellum arises from the package's failure to properly sanitize URLs for data URIs. This oversight enables attackers to inject malicious code into a victim's browser, potentially leading to the execution of arbitrary code. By exploiting this vulnerability, an attacker can compromise the integrity and confidentiality of user data, perform actions on behalf of the user, or even gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2.5.5
This is the first release that contains the fix.
npm install pannellum@2.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Pannellum package prior to version 2.5.6 is susceptible to a Cross-Site Scripting vulnerability that allows attackers to execute arbitrary code in a victim's browser. To mitigate this risk, it is crucial to upgrade to the fixed version of the package. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pannellum →
FAQ
This vulnerability allows attackers to execute arbitrary code in a victim's browser, potentially leading to various malicious activities such as data theft, unauthorized access, and privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the Pannellum package.
Yes, this vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/11/GHSA-m52x-29pq-w3vv/GHSA-m52x-29pq-w3vv.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pannellum.
