~ / search / GHSA-4532-pmx7-9ww7

GHSA-4532-pmx7-9ww7

Withdrawn on 2023-12-19. GitHub withdrew this advisory; it no longer applies.

Cross-site Scripting in cesium

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-48094

Packages

EcosystemPackageAffectedFixed in
npm cesium <= 1.111.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product.'

References

External links from the advisory. They lead to third-party sites.