Executive brief
three.js is a popular JavaScript 3D library used to build interactive 3D visualizations in web browsers. Versions before 0.137.0 load untrusted iframes, allowing attackers to inject arbitrary JavaScript code into a user's browser session. This could enable credential theft, malware delivery, or session hijacking against users visiting affected applications.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in three.js's iframe loading mechanism. Prior to version 0.137.0, the library loads iframes without properly validating their source, allowing attackers to inject malicious JavaScript into the user's browser context. The attack requires user interaction (opening a page with the vulnerable library) and is network-accessible with no authentication required. An attacker can achieve arbitrary JavaScript execution with user privileges. The fix was merged in January 2022 and released in version 0.137.0.
Affected products
- three.js three.js prior to 0.137.0
Timeline
- 2022-01-24: disclosed: Vulnerability reported and validated
- 2022-01-24: patched: Patch merged into dev branch
- 2022-01-27: advisory: GHSA-7vvq-7r29-5vg3 published