CVE-2022-0177: Cross-Site Scripting in three.js
Summary
GHSA-7vvq-7r29-5vg3: Cross site scripting in three.js. Affects three versions < 0.137.0. Fixed in 0.137.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
three.js is a popular JavaScript library used for creating and rendering 3D computer graphics in web browsers. It provides a wide range of features and functionalities for building interactive and visually appealing 3D applications. However, versions of three.js prior to 0.137.0 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows attackers to inject arbitrary JavaScript code into a user's browser by exploiting the loading of untrusted iframes.
Vulnerability Detail
The vulnerability in three.js versions prior to 0.137.0 arises from the insecure loading of iframes, which can be manipulated by attackers to inject malicious JavaScript code. This can lead to various security risks, including unauthorized access to user data, session hijacking, and the execution of arbitrary actions on behalf of the user. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 0.186.1 as of 23 Oct 2026
npm install three@0.186.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.137.0
This is the first release that contains the fix.
npm install three@0.137.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of three.js to mitigate the risk of exploitation.
Conclusion
In conclusion, the vulnerability in three.js versions prior to 0.137.0 exposes users to the risk of cross-site scripting attacks. It is crucial to update to the patched version of three.js (0.137.0 or later) to mitigate this vulnerability. Failure to do so may result in unauthorized access to user data and the execution of malicious actions. For further support and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for three →
FAQ
three.js is a JavaScript library for creating and rendering 3D computer graphics in web browsers. It provides a comprehensive set of tools and features for building interactive 3D applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
The vulnerability in three.js can allow attackers to inject arbitrary JavaScript code into a user's browser. This can lead to unauthorized access to user data, session hijacking, and the execution of malicious actions on behalf of the user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for three.
