Description (CNA)
This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / vis-timeline | affected unspecified before 7.4.4 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
- https://github.com/visjs/vis-timeline/issues/838
- https://github.com/visjs/vis-timeline/pull/840
ADP enrichment
No English description supplied.