Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTltcnYtNDU2di1wZjIy

Cross-site Scripting in vis-timeline

This affects the package vis-timeline before 7.4.4.
An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

Permalink: https://github.com/advisories/GHSA-9mrv-456v-pf22
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTltcnYtNDU2di1wZjIy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 4 years ago
Updated: almost 2 years ago


CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

EPSS Percentage: 0.00265
EPSS Percentile: 0.655

Identifiers: GHSA-9mrv-456v-pf22, CVE-2020-28487
References: Repository: https://github.com/visjs/vis-timeline
Blast Radius: 17.2

Affected Packages

npm:vis-timeline
Dependent packages: 57
Dependent repositories: 334
Downloads: 220,605 last month
Affected Version Ranges: < 7.4.4
Fixed in: 7.4.4
All affected versions: 5.0.0, 5.1.0, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.5.0, 6.5.1, 6.5.2, 7.0.0, 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 7.3.10, 7.3.11, 7.3.12, 7.4.0, 7.4.1, 7.4.2, 7.4.3
All unaffected versions: 7.4.4, 7.4.5, 7.4.6, 7.4.7, 7.4.8, 7.4.9, 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.7.1, 7.7.2, 7.7.3