Executive brief
Pivottable is a popular JavaScript library for creating interactive pivot tables from data. Versions 1.4.0 through 1.9.x contain a cross-site scripting (XSS) vulnerability due to improper handling of user data when rendering JSON elements. An attacker can inject malicious JavaScript that executes in the browser of any user viewing a pivot table with untrusted data, leading to account compromise, data theft, or malware distribution.
Technical details
The vulnerability is a Stored/Reflected XSS issue (CWE-79) introduced in version 1.4.0 when the library changed from text-safe methods (textContent, text()) to HTML-unsafe methods (innerHTML, html()) for rendering data elements. The root cause is insufficient input sanitization when rendering JSON data into the DOM. An attacker can craft a pivot table configuration with JavaScript payloads in data fields (e.g., color, shape properties), which are then executed when the library renders them as HTML. The attack requires the attacker to control or manipulate data passed to the pivottable library, but no additional authentication or special preconditions are required. The fix was released in version 2.0.0, which reverts the library to using text-based DOM methods.
Affected products
- pivottable pivottable 1.4.0 to 1.9.x
Timeline
- 2015-11-03: disclosed: Vulnerability reported via GitHub PR #401
- 2.0.0: patched: Fix released by reverting to text-based DOM methods
- 2020-09-01: advisory: GitHub Security Advisory GHSA-cjj8-wfrx-jqcf published