CVE-2017-1000043
MEDIUMMapbox.js <1.6.6, <2.2.4 - XSS
Title source: llmDescription
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
Scores
CVSS v3
6.1
EPSS
0.0016
EPSS Percentile
37.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (4)
mapbox/mapbox.js
< 1.6.6
npm/mapbox.js
< 1.6.6npm
rubygems/mapbox-rails
< 1.6.6RubyGems
n/a/n/a
Published
Jul 17, 2017
Tracked Since
Feb 18, 2026