XSS in Pannellum from 2.5.0 through 2.5.4
Description
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an <iframe> could then be embedded on the attacker's site using pannellum.htm from the targeted site, which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pannellumnpm | >= 2.5.0, < 2.5.5 | 2.5.5 |
Affected products
1Patches
1cc2f3d99953dMerge pull request from GHSA-m52x-29pq-w3vv
1 file changed · +13 −6
src/js/pannellum.js+13 −6 modified@@ -1719,7 +1719,7 @@ function createHotSpot(hs) { if (config.basePath && !absoluteURL(imgp)) imgp = config.basePath + imgp; a = document.createElement('a'); - a.href = sanitizeURL(hs.URL ? hs.URL : imgp); + a.href = sanitizeURL(hs.URL ? hs.URL : imgp, true); a.target = '_blank'; span.appendChild(a); var image = document.createElement('img'); @@ -1731,7 +1731,7 @@ function createHotSpot(hs) { span.style.maxWidth = 'initial'; } else if (hs.URL) { a = document.createElement('a'); - a.href = sanitizeURL(hs.URL); + a.href = sanitizeURL(hs.URL, true); if (hs.attributes) { for (var key in hs.attributes) { a.setAttribute(key, hs.attributes[key]); @@ -2005,7 +2005,7 @@ function processOptions(isPreview) { var authorText = escapeHTML(config[key]); if (config.authorURL) { var authorLink = document.createElement('a'); - authorLink.href = sanitizeURL(config['authorURL']); + authorLink.href = sanitizeURL(config['authorURL'], true); authorLink.target = '_blank'; authorLink.innerHTML = escapeHTML(config[key]); authorText = authorLink.outerHTML; @@ -2016,7 +2016,7 @@ function processOptions(isPreview) { case 'fallback': var link = document.createElement('a'); - link.href = sanitizeURL(config[key]); + link.href = sanitizeURL(config[key], true); link.target = '_blank'; link.textContent = 'Click here to view this panorama in an alternative viewer.'; var message = document.createElement('p'); @@ -2378,10 +2378,17 @@ function escapeHTML(s) { * The URL cannot be of protocol 'javascript'. * @private * @param {string} url - URL to sanitize + * @param {boolean} href - True if URL is for link (blocks data URIs) * @returns {string} Sanitized URL */ -function sanitizeURL(url) { - if (url.trim().toLowerCase().indexOf('javascript:') === 0) { +function sanitizeURL(url, href) { + if (url.trim().toLowerCase().indexOf('javascript:') === 0 || + url.trim().toLowerCase().indexOf('vbscript:') === 0) { + console.log('Script URL removed.'); + return 'about:blank'; + } + if (href && url.trim().toLowerCase().indexOf('data:') === 0) { + console.log('Data URI removed from link.'); return 'about:blank'; } return url;
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-m52x-29pq-w3vvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-16763ghsaADVISORY
- github.com/mpetroff/pannellum/commit/cc2f3d99953de59db908e0c6efd1c2c17f7c6914ghsax_refsource_MISCWEB
- github.com/mpetroff/pannellum/security/advisories/GHSA-m52x-29pq-w3vvghsax_refsource_CONFIRMWEB
- www.npmjs.com/advisories/1418ghsaWEB
News mentions
0No linked articles in our index yet.