Cross Site Scripting (XSS) in plotly.js

MEDIO 6.1CVE-2017-1000006 · GHSA-2fqv-h3r5-m4vf · Published 17/07/2017 · updated 17/06/2026

In breve

CVE-2017-1000006 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda plotly.js (plotly), plotly.js.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.88%, superiore al 59.2% delle vulnerabilità.
Correzione: aggiornare a 1.16.0 o successiva.

Package	Affected versions	Patched versions
plotly.js plotly	`= 1.11.0= 1.12.0= 1.13.0= 1.14.0= 1.14.1= 1.14.2= 1.15.0`	No fix yet
plotly.js npm	`< 1.16.0`	`1.16.0`

Description

Affected versions of plotly.js are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.

Recommendation

Update to 1.16.0 or later.

NVD description

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000006 · ADVISORY
acloudtree.com/2016-08-09-how-i-hacked-plotly-by-exploiting-a-svg-vulnerability-in-plotlyjs · WEB
GitHub Advisory GHSA-2fqv-h3r5-m4vf · ADVISORY
npmjs.com/advisories/145 · WEB
help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory · WEB
help.plot.ly/security-advisories/2016-08-08-plotlyjs-xss-advisory · Vendor Advisory

Altre vulnerabilità di plotly.js

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

plotly.js

plotly

= 1.11.0= 1.12.0= 1.13.0= 1.14.0= 1.14.1= 1.14.2= 1.15.0

No fix yet

plotly.js

npm

< 1.16.0

1.16.0