CVE-2017-1000042

MEDIUM

Mapbox.js <1.6.5, <2.1.7 - XSS

Title source: llm

Description

Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.

References (2)

[Exploit, Third Party Advisory] https://hackerone.com/reports/54327

[Third Party Advisory] https://nodesecurity.io/advisories/49

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 37.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (36)

mapbox_project/mapbox

... and 26 more

Published Jul 17, 2017

Tracked Since Feb 18, 2026