~ / search / GHSA-9mrv-456v-pf22

GHSA-9mrv-456v-pf22

Cross-site Scripting in vis-timeline

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-28487

Packages

EcosystemPackageAffectedFixed in
npm vis-timeline < 7.4.4 7.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

References

External links from the advisory. They lead to third-party sites.