High severity8.8NVD Advisory· Published Mar 13, 2018· Updated Jun 17, 2026
CVE-2018-1000086
CVE-2018-1000086
Description
NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pym.jsnpm | >= 0.4.2, < 1.3.2 | 1.3.2 |
Affected products
1Patches
Vulnerability mechanics
References
5- blog.apps.npr.org/2018/02/15/pym-security-vulnerability.htmlnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-82gw-pqf7-q3j2ghsaADVISORY
- github.com/nprapps/pym.js/issues/170nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2018-1000086ghsaADVISORY
- github.com/nprapps/pym.js/commit/c3552a6cf2532664c17bd6a318fb3cf8e4cf2f97ghsaWEB
News mentions
0No linked articles in our index yet.