CVE-2026-27210

描述

### Impact The hot spot `attributes` configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the `escapeHTML` parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file—without additional user interaction—is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. ### Patches This has been fixed both in v2.5.7 and in the current development branch. ### Workarounds Setting the `Content-Security-Policy` header to `script-src-attr 'none'` will block execution of inline event handlers, mitigating this vulnerability. Don't host `pannellum.htm` on a domain that shares cookies with user authentication to mitigate XSS risk. ### Acknowledgments Reported both by luminary (@lumin9ry), Visvge (@Sicclord1 / @Visvge), and sutol (@0x5a6163 / @SUT0L) and by another researcher who wishes not to be named at this time.

如何修補 CVE-2026-27210

要修補 CVE-2026-27210,請將受影響套件升級到下列已修補版本。

• —升級至 2.5.7 或更新版本

CVE-2026-27210 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.5.0, < 2.5.7

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-27210
• PATCHgithub.com/mpetroff/pannellum
• WEBgithub.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681
• WEBgithub.com/mpetroff/pannellum/security/advisories/GHSA-8423-w5wx-h2r6