Description

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

Remediation

References

https://github.com/visjs/vis-timeline/issues/838

https://github.com/visjs/vis-timeline/pull/840

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501

https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500

Related Vulnerabilities

CVE-2014-3630 Vulnerability in maven package com.typesafe.play:play_2.10

CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.11

CVE-2019-10759 Vulnerability in maven package org.webjars.npm:safer-eval

CVE-2018-11011 Vulnerability in maven package cc.ryanc:halo

CVE-2021-29418 Vulnerability in npm package netmask

Severity

Critical

Classification

CWE-79

Tags

Issue Tracking Third Party Advisory Patch Exploit