GHSA-8423-w5wx-h2r6

Source

https://github.com/advisories/GHSA-8423-w5wx-h2r6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-8423-w5wx-h2r6/GHSA-8423-w5wx-h2r6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8423-w5wx-h2r6

Aliases

CVE-2026-27210

Published

2026-02-19T20:44:48Z

Modified

2026-02-23T23:43:43.699402Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Pannellum has a XSS vulnerability in hot spot attributes

Details

Impact

The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file—without additional user interaction—is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file.

Patches

This has been fixed both in v2.5.7 and in the current development branch.

Workarounds

Setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this vulnerability. Don't host pannellum.htm on a domain that shares cookies with user authentication to mitigate XSS risk.

Acknowledgments

Reported both by luminary (@lumin9ry), Visvge (@Sicclord1 / @Visvge), and sutol (@0x5a6163 / @SUT0L) and by another researcher who wishes not to be named at this time.

Database specific

{
    "nvd_published_at": "2026-02-21T06:17:01Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2026-02-19T20:44:48Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true
}

References

Affected packages

npm / pannellum

Package

Name: pannellum; View open source insights on deps.dev
Purl: pkg:npm/pannellum

Affected ranges

Type: SEMVER
Events: Introduced

2.5.0

Fixed

2.5.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-8423-w5wx-h2r6/GHSA-8423-w5wx-h2r6.json"