Описание
Cross site scripting in three.js
CVE has been withdrawn
Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
Пакеты
Наименование
three
npm
Затронутые версииВерсия исправления
< 0.137.0
0.137.0
Связанные уязвимости
nvd
около 4 лет назад
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage