Executive brief
vis-timeline is a popular JavaScript library for displaying interactive timelines in web applications. An attacker who can control the data items displayed in a timeline can inject malicious JavaScript code that executes in users' browsers, allowing session hijacking, credential theft, or malware distribution to application users.
Technical details
This is a DOM-based cross-site scripting (CWE-79) vulnerability in the vis-timeline JavaScript library versions before 7.4.4. The vulnerability exists because the library fails to properly sanitize or escape user-controllable timeline item data before rendering it into the DOM. An authenticated attacker with the ability to inject or control timeline items (e.g., through a database, API parameter, or file upload) can embed malicious HTML and JavaScript that executes in the context of any user viewing the timeline. Exploitation requires user interaction (the victim must view a page containing the affected timeline) and authenticated access to provide malicious data. The fix was implemented in version 7.4.4 and is available via a commit to the main repository.
Affected products
- vis.js vis-timeline before 7.4.4
Timeline
- 2021-01-22: disclosed: CVE-2020-28487 published by NVD
- 2021-04-13: advisory: GHSA-9mrv-456v-pf22 published
- 2021-04-13: patched: Fix released in version 7.4.4