Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Pannellum: Malicious Content Can Run Without User Interaction
CVE-2026-27210
GHSA-8423-w5wx-h2r6
Summary
Websites using Pannellum's viewer may be at risk of a security threat if an attacker can upload a malicious configuration file. This could allow an attacker to take control of the website, replacing its content and making it appear as if the attack came from the website itself. To stay safe, update to the latest version of Pannellum or use specific security settings on your website.
What to do
- Update mpetroff pannellum to version 2.5.7.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| mpetroff | pannellum | > 2.5.0 , <= 2.5.7 | 2.5.7 |
| pannellum | pannellum | > 2.5.0 , <= 2.5.7 | – |
Original title
Pannellum has a XSS vulnerability in hot spot attributes
Original description
### Impact
The hot spot `attributes` configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the `escapeHTML` parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file—without additional user interaction—is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file.
### Patches
This has been fixed both in v2.5.7 and in the current development branch.
### Workarounds
Setting the `Content-Security-Policy` header to `script-src-attr 'none'` will block execution of inline event handlers, mitigating this vulnerability. Don't host `pannellum.htm` on a domain that shares cookies with user authentication to mitigate XSS risk.
### Acknowledgments
Reported both by luminary (@lumin9ry), Visvge (@Sicclord1 / @Visvge), and sutol (@0x5a6163 / @SUT0L) and by another researcher who wishes not to be named at this time.
The hot spot `attributes` configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the `escapeHTML` parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file—without additional user interaction—is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file.
### Patches
This has been fixed both in v2.5.7 and in the current development branch.
### Workarounds
Setting the `Content-Security-Policy` header to `script-src-attr 'none'` will block execution of inline event handlers, mitigating this vulnerability. Don't host `pannellum.htm` on a domain that shares cookies with user authentication to mitigate XSS risk.
### Acknowledgments
Reported both by luminary (@lumin9ry), Visvge (@Sicclord1 / @Visvge), and sutol (@0x5a6163 / @SUT0L) and by another researcher who wishes not to be named at this time.
nvd CVSS3.1
6.1
nvd CVSS4.0
5.3
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 19 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026