Executive brief
Plotly.js is a popular open-source JavaScript library used for creating interactive charts and data visualizations. A security flaw in versions prior to 1.16.0 allows an attacker to execute malicious scripts in a user's browser if the user views a specially crafted plot. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in plotly.js versions prior to 1.16.0. The issue stems from improper neutralization of user-controllable input during the generation of SVG-based plots. An attacker can exploit this by creating a malicious plot that, when rendered by the library, executes arbitrary JavaScript in the context of the victim's browser session. This is a client-side attack requiring the victim to view the malicious content (User Interaction: Required). The vulnerability was addressed in version 1.16.0 by improving input sanitization.
Affected products
- Plotly plotly.js < 1.16.0
Timeline
- 2016-08-08: advisory: Original vendor security advisory released
- 2017-07-17: disclosed: NVD published CVE-2017-1000006
- 2017-10-24: advisory: GitHub Advisory published