GitHub Advisoryadvisory · npm

GHSA-9mrv-456v-pf22 Cross-site Scripting in vis-timeline

MEDIUM Published 2021-04-13 Modified 2021-03-22 Official page ↗
Aliases
CVE-2020-28487
Ecosystem
npm
Packages
vis-timeline
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-79
Reviewed
2021-03-22

Affected packages

• npm vis-timeline: < 7.4.4 → fixed in 7.4.4

Description

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

Related

Alias · CVE (1)

  • CVE-2020-28487 This affects the package vis-timeline before 7.4.4. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References