npm mapbox.js vulnerabilities

Latest npm mapbox.js CVEs

Newest publication first

1. CVE-2017-1000042 Content Injection via TileJSON attribute in mapbox.js

   Published 2017-07-13

   Medium·CVSS 6.1 EPSS 0.93% PoC

   Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.

2. CVE-2017-1000043 Content Injection via TileJSON Name in mapbox.js

   Published 2017-07-13

   Medium·CVSS 6.1 EPSS 0.94% PoC

   Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.