CVE-2026-27210

Pannellum has a XSS vulnerability in hot spot attributes

Published Feb 21, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file — without additional user interaction — is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. This issue has been fixed in version 2.5.7. To workaround, setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this vulnerability. Don't host pannellum.htm on a domain that shares cookies with user authentication to mitigate XSS risk.

Analysis

Technical impact

Hotspot configuration in Pannellum allows any attribute to be set, including HTML event handler attributes that execute JavaScript without user interaction. This flaw enables a cross‑site scripting attack where visiting a malicious viewer URL or loading a JSON configuration file can run arbitrary code, modify page content, and impersonate the hosting site. The vulnerability is identified as CWE‑79.

Affected Systems

The issue exists in Pannellum versions 2.5.6 through 3.5.0 inclusive, distributed by mpetroff. Any deployment using the standalone viewer HTML file or untrusted JSON configuration falls within the affected range.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks can be launched simply by delivering a malicious hotspot configuration to visitors; no authentication or privileged access is required. The exploit path is straightforward: host the viewer, point it to a crafted configuration file, and observe the automatic execution of embedded JavaScript.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mpetroff

pannellum

affected

Version	Status	Constraints
`>= 2.5.0, < 2.5.7`	affected	—

Configuration 1 [-]

cpe:2.3:a:pannellum:pannellum:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Mpetroff

Pannellum

Version	Status	Scheme	Platform
`[2.5.0,2.5.7)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Pannellum to version 2.5.7 or later, which removes the ability to set arbitrary hotspot attributes.
If an immediate upgrade is not feasible, configure the web server to send a Content‑Security‑Policy header that includes ‘script‑src‑attr 'none'' to block inline event handlers from executing.
Avoid serving the pannellum.htm file from any domain that shares authentication cookies; use a dedicated domain or subdomain to isolate the viewer from application session data.

Generated by OpenCVE AI on April 17, 2026 at 16:53 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-8423-w5wx-h2r6	Pannellum has a XSS vulnerability in hot spot attributes

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.368% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681
https://github.com/mpetroff/pannellum/security/advisories/GHSA-8423-w5wx-h2r6

History

Mar 2, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Pannellum Pannellum pannellum
CPEs		cpe:2.3:a:pannellum:pannellum::::::::
Vendors & Products		Pannellum Pannellum pannellum
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Feb 25, 2026 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 23, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mpetroff Mpetroff pannellum
Vendors & Products		Mpetroff Mpetroff pannellum

Feb 21, 2026 5:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file — without additional user interaction — is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. This issue has been fixed in version 2.5.7. To workaround, setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this vulnerability. Don't host pannellum.htm on a domain that shares cookies with user authentication to mitigate XSS risk.
Title		Pannellum has a XSS vulnerability in hot spot attributes
Weaknesses		CWE-79
References		https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681 https://github.com/mpetroff/pannellum/security/advisories/GHSA-8423-w5wx-h2r6
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`