Description
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
Remediation
References
https://hackerone.com/reports/54327
https://nodesecurity.io/advisories/49
Related Vulnerabilities
CVE-2021-23597 Vulnerability in npm package fastify-multipart
CVE-2016-7103 Vulnerability in maven package org.webjars:jquery-ui
CVE-2022-24717 Vulnerability in npm package @finastra/ssr-pages
CVE-2020-27219 Vulnerability in maven package org.eclipse.hawkbit:hawkbit-update-server
CVE-2023-29518 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui