CVE-2026-27210 Pannellum has a XSS vulnerability in hot spot attributes
Attackers can execute arbitrary JavaScript via malicious hotspot attributes in Pannellum, potentially leading to account takeover or page defacement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27210?
CVE-2026-27210 is a medium-severity cross-site scripting vulnerability in mpetroff pannellum, published on 21 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file — without additional user interaction — is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. This issue has been fixed in version 2.5.7. To workaround, setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this vulnerability. Don't host pannellum.htm on a domain that shares cookies with user authentication to mitigate XSS risk.
Weakness: CWE-79
Which versions are affected by CVE-2026-27210?
2 open source packages ship an affected version, including pannellum. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pannellum npm | From 2.5.0 | 2.5.7 |
pannellum npm | From 2.5.0 | 2.5.7 |
Products include Pannellum Pannellum.
How do I fix CVE-2026-27210?
Upgrade pannellum to 2.5.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-27210 being exploited?
There is no known exploitation of CVE-2026-27210 in the wild and no public exploit code.
Other vulnerabilities in mpetroff pannellum
Sources
Also known as GHSA-8423-w5wx-h2r6.