Executive brief
Pannellum is a web-based panoramic image viewer widely used to display interactive 360-degree photos. A cross-site scripting (XSS) vulnerability in its configuration allows attackers to inject malicious code through untrusted panorama configuration files. An attacker can craft a malicious configuration URL that, when visited, executes arbitrary JavaScript in the viewer's context—potentially stealing user data, defacing content, or impersonating the hosting website.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the hot spot attributes configuration property, which failed to properly validate or sanitize HTML event handler attributes. An attacker can supply a malicious JSON configuration file through a URL parameter pointing to Pannellum's standalone viewer, injecting event handlers (e.g., onload, onmouseover) that execute without requiring additional user interaction. The vulnerability affects versions 2.5.0 through 2.5.6 when hosting untrusted configuration sources. It bypasses the escapeHTML parameter protection and has been patched in v2.5.7. Workarounds include setting Content-Security-Policy headers to block inline event handlers.
Affected products
- Pannellum Pannellum 2.5.0 through 2.5.6
Timeline
- 2026-02-19: disclosed: GHSA-8423-w5wx-h2r6 published
- 2026-02-19: patched: Fixed in version 2.5.7