Description
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
Remediation
References
https://nodesecurity.io/advisories/74
https://hackerone.com/reports/99245
Related Vulnerabilities
CVE-2016-0706 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2021-23470 Vulnerability in npm package putil-merge
CVE-2017-12610 Vulnerability in maven package org.apache.kafka:kafka_2.10
CVE-2023-26486 Vulnerability in npm package vega-functions
CVE-2019-11272 Vulnerability in maven package org.springframework.security:spring-security-core