CVE-2026-27210

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the escapeHTML parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file — without additional user interaction — is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file. This issue has been fixed in version 2.5.7. To workaround, setting the Content-Security-Policy header to script-src-attr 'none' will block execution of inline event handlers, mitigating this vulnerability. Don't host pannellum.htm on a domain that shares cookies with user authentication to mitigate XSS risk.

• CWE-79

• https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681Patch
• https://github.com/mpetroff/pannellum/security/advisories/GHSA-8423-w5wx-h2r6Mitigation, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27203eBay API MCP Server is an open source local MCP server provi…8.3
• CVE-2026-27204Wasmtime is a runtime for WebAssembly. Prior to versions 24.…6.5
• CVE-2026-27205Flask is a web server gateway interface (WSGI) web applicati…4.3
• CVE-2026-27206Zumba Json Serializer is a library to serialize PHP variable…8.1
• CVE-2026-27208bleon-ethical/api-gateway-deploy provides API gateway deploy…7.8
• CVE-2026-2721The MailArchiver plugin for WordPress is vulnerable to Store…4.8
• CVE-2026-27211Cloud Hypervisor is a Virtual Machine Monitor for Cloud work…10
• CVE-2026-27212Swiper is a free and mobile touch slider with hardware accel…7.8
• CVE-2026-27214Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27215Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27216Substance3D - Painter versions 11.1.2 and earlier are affect…5.5
• CVE-2026-27217Substance3D - Painter versions 11.1.2 and earlier are affect…5.5