Description
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mapbox.js | < 1.6.5 | 1.6.5 | GHSA-qr28-7j6p-9hmv |
| npm | mapbox.js | >= 2.0.0, < 2.1.7 | 2.1.7 | GHSA-qr28-7j6p-9hmv |
| RubyGems | mapbox-rails | >= 1.0.0, < 1.6.5 | 1.6.5 | GHSA-qr28-7j6p-9hmv |
| RubyGems | mapbox-rails | >= 2.0.0, < 2.1.7 | 2.1.7 | GHSA-qr28-7j6p-9hmv |