Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

pannellum

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    Pannellum has a XSS vulnerability in hot spot attributes

    CVE-2026-27210 · GHSA-8423-w5wx-h2r6

    Affected
    • npm pannellum >= 2.5.0, < 2.5.7
    Fixed in
    2.5.7· Vendor fix available
    Issue
    Impact The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file&mdash;without additional user interaction&mdash;is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. Patches This has been fixed both in v2.5.7 and in the current development branch. Workarounds Setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this…

    Recommended action: Upgrade to 2.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 4.8npmAmendedPublished

    Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript

    CVE-2019-16763 · GHSA-m52x-29pq-w3vv

    Affected
    • npm pannellum >= 2.5.0, < 2.5.5
    Fixed in
    2.5.5· Vendor fix available
    Issue
    Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser. Recommendation Upgrade to version 2.5.6 or later.

    Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →