CVE-2020-7749: Injection and Cross-site Scripting in osm-static-maps
Summary
CVE-2020-7749: Injection and Cross-site Scripting in osm-static-maps. Affects osm-static-maps versions < 3.9.0. Fixed in 3.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The osm-static-maps package is an npm package that provides functionality for generating static maps using OpenStreetMap data. It allows users to input data that is then passed to a template for rendering. The package is vulnerable to injection and cross-site scripting (XSS) attacks due to user input not being properly escaped before being rendered on the page or on the server using puppeteer. This vulnerability affects all versions of the package up to version 3.9.0.
Vulnerability Detail
The vulnerability arises from user input being directly passed to a template without proper escaping. This allows an attacker to inject arbitrary HTML/JS code, which can lead to XSS attacks. Depending on the context, the injected code can be outputted as HTML on the page, providing an opportunity for XSS, or it can be rendered on the server using puppeteer, which opens up the possibility of server-side request forgery (SSRF) and local file read attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.6.
How To Fix
Latest published version: 5.0.0 as of 22 Oct 2026
npm install osm-static-maps@5.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.0
This is the first release that contains the fix.
npm install osm-static-maps@3.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually sanitize user input before passing it to the package. This can be done using a library like DOMPurify to sanitize the input and remove any potentially malicious code.
Conclusion
The osm-static-maps package is vulnerable to injection and cross-site scripting attacks. Upgrading to version 3.9.0 or later of the package is recommended to fix this vulnerability. In the meantime, manual sanitization of user input can serve as a temporary workaround. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for osm-static-maps →
FAQ
osm-static-maps is an npm package that allows users to generate static maps using OpenStreetMap data. It provides a convenient way to include maps in web applications without relying on external map services.
Injection refers to the ability to inject malicious code or data into an application, potentially leading to security vulnerabilities. Cross-site scripting (XSS) is a type of injection attack where an attacker injects malicious scripts into web pages viewed by other users.
The injection and XSS vulnerability in osm-static-maps can allow an attacker to execute arbitrary code on the client-side, potentially leading to unauthorized access, data theft, or manipulation of the application's functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your application.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
