Description
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mapbox.js | < 1.6.6 | 1.6.6 | GHSA-q69p-5h74-w36f |
| npm | mapbox.js | >= 2.0.0, < 2.2.4 | 2.2.4 | GHSA-q69p-5h74-w36f |
| RubyGems | mapbox-rails | >= 1.0.0, < 1.6.6 | 1.6.6 | GHSA-q69p-5h74-w36f |
| RubyGems | mapbox-rails | >= 2.0.0, < 2.2.4 | 2.2.4 | GHSA-q69p-5h74-w36f |