CVE-2020-28487: Cross-site Scripting in vis-timeline
6.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.65751%
CWE
Published
4/13/2021
Updated
2/1/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
vis-timeline | npm | < 7.4.4 | 7.4.4 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from multiple instances where user-controlled input was directly assigned to innerHTML without proper sanitization. The GitHub commit diff shows these functions were modified to add xss() sanitization in version 7.4.4. Key indicators include: 1) Direct innerHTML assignments of user-controlled content fields like item titles and group IDs 2) The pattern of adding util.xss() wrappers in the patched version 3) The XSS vulnerability description explicitly mentions timeline item content injection as the attack vector. These functions handle critical rendering paths for user-supplied content in timeline elements.