CVE-2020-8127

MEDIUM

reveal.js < 3.9.1 - Cross-Site Scripting via postMessage

Title source: llm

Description

Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/691977

Scores

CVSS v3 6.1

EPSS 0.0120

EPSS Percentile 64.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

npm/reveal.js 0 - 3.9.2npm

revealjs/reveal.js < 3.9.1

Published Feb 28, 2020

Tracked Since Feb 18, 2026