Cross Site Scripting (XSS) in plotly.js

MOYENNE 6.1CVE-2017-1000006 · GHSA-2fqv-h3r5-m4vf · Published 17/07/2017 · updated 17/06/2026

En bref

CVE-2017-1000006 est une vulnérabilité MOYENNE (CVSS 6.1) touchant plotly.js (plotly), plotly.js.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.88%, plus élevée que 59.2% des vulnérabilités.
Correctif : mettre à jour vers 1.16.0 ou plus récent.

Package	Affected versions	Patched versions
plotly.js plotly	`= 1.11.0= 1.12.0= 1.13.0= 1.14.0= 1.14.1= 1.14.2= 1.15.0`	No fix yet
plotly.js npm	`< 1.16.0`	`1.16.0`

Description

Affected versions of plotly.js are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.

Recommendation

Update to 1.16.0 or later.

NVD description

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000006 · ADVISORY
acloudtree.com/2016-08-09-how-i-hacked-plotly-by-exploiting-a-svg-vulnerability-in-plotlyjs · WEB
GitHub Advisory GHSA-2fqv-h3r5-m4vf · ADVISORY
npmjs.com/advisories/145 · WEB
help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory · WEB
help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory · Vendor Advisory

Autres vulnérabilités de plotly.js

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

plotly.js

plotly

= 1.11.0= 1.12.0= 1.13.0= 1.14.0= 1.14.1= 1.14.2= 1.15.0

No fix yet

plotly.js

npm

< 1.16.0

1.16.0