CVE-2020-15092: Stored XSS in TimelineJS3
Summary
CVE-2020-15092: Stored XSS in TimelineJS3. Affects @knight-lab/timelinejs versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TimelineJS is an open-source JavaScript library that allows users to create interactive timelines. It renders user data as HTML, making it susceptible to cross-site scripting (XSS) attacks. The vulnerability exists in both Google Sheets and JSON configuration file data sources. Users who grant write access to the document or have compromised access are at risk. The severity of this vulnerability is Moderate with a CVSS v3.1 base score of 7.2.
Vulnerability Detail
The vulnerability in TimelineJS3 allows an attacker to execute malicious code by injecting crafted content into various data fields. This can occur when the timeline is configured with a Google Sheets document or a JSON configuration file. The risk is present if the attacker gains write access to the data source or compromises the access of a trusted user. The impact of exploitation can lead to unauthorized access, data manipulation, or other malicious activities. The vulnerability has been addressed in version 3.7.0 of TimelineJS by sanitizing content and stripping markup.
How To Fix
Minimum fixed version
3.7.0
This is the first release that contains the fix.
npm install @knight-lab/timelinejs@3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
The only workaround for this vulnerability is to ensure the secure write access to the Google Sheet or JSON file used as the data source for the TimelineJS. This can help prevent unauthorized modification or injection of malicious content.
Conclusion
TimelineJS3 is vulnerable to stored XSS attacks when using Google Sheets or JSON configuration files as data sources. The vulnerability has been addressed in version 3.7.0 by sanitizing content and stripping markup. Users are advised to update to the latest version and secure write access to the data source. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @knight-lab/timelinejs →
FAQ
TimelineJS is an open-source JavaScript library for creating interactive timelines.
The vulnerability allows an attacker to execute malicious code, potentially leading to unauthorized access or data manipulation.
Update to version 3.7.0 of TimelineJS and ensure secure write access to the data source.
The only workaround is to secure write access to the data source, such as the Google Sheet or JSON file.
This vulnerability was discovered by Zander Work of Oregon State University.
