CVE-2026-27210 Overview
CVE-2026-27210 is a Cross-Site Scripting (XSS) vulnerability affecting Pannellum, a lightweight, free, and open source panorama viewer for the web. The vulnerability exists in versions 3.5.0 through 2.5.6 where the hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes. This enables attackers to inject malicious JavaScript code that executes in the context of the affected website.
The vulnerability is particularly concerning because certain events fire without requiring additional user interaction. Simply visiting a standalone viewer URL that points to a malicious config file is sufficient to trigger the vulnerability and execute arbitrary JavaScript code.
Critical Impact
Attackers can execute arbitrary JavaScript code to replace page contents with malicious content that appears to be hosted by the legitimate website, potentially leading to credential theft, session hijacking, or further exploitation of users.
Affected Products
- Pannellum versions 2.5.0 through 2.5.6
- Websites hosting the standalone viewer HTML file (pannellum.htm)
- Applications using untrusted JSON config files with Pannellum
Discovery Timeline
- 2026-02-21 - CVE-2026-27210 published to NVD
- 2026-02-23 - Last updated in NVD database
Technical Details for CVE-2026-27210
Vulnerability Analysis
This vulnerability stems from insufficient input validation in the hot spot attributes handling functionality within Pannellum. The setAttribute() method in JavaScript converts attribute keys to lowercase strings, but prior to the fix, no filtering was performed to prevent HTML event handler attributes (such as onclick, onmouseover, onerror, etc.) from being set through untrusted JSON configuration files.
When a malicious configuration file specifies event handler attributes in the hot spot configuration, the browser interprets these as legitimate event handlers and executes the contained JavaScript when the corresponding event triggers. This effectively bypasses the protections offered by the escapeHTML parameter, as the injection occurs at the attribute level rather than within HTML content.
Root Cause
The root cause is an improper input validation issue (CWE-79) in the src/js/pannellum.js file. The hot spot attributes configuration allowed arbitrary attributes to be set on anchor elements without filtering potentially dangerous attributes like event handlers (on* attributes) or href attributes that could contain javascript: URIs.
Attack Vector
The attack requires an attacker to craft a malicious JSON configuration file containing event handler attributes in the hot spot configuration. The attack can be executed via:
- Hosting a malicious JSON config file on an attacker-controlled server
- Tricking users into visiting a standalone viewer URL that references the malicious config
- The malicious JavaScript executes automatically when certain events fire, without additional user interaction
This is a network-based attack that exploits passive user interaction (simply visiting a crafted URL).
a.href = sanitizeURL(hs.URL, true);
if (hs.attributes) {
for (var key in hs.attributes) {
- a.setAttribute(key, hs.attributes[key]);
+ // The setAttribute method converts the key to a lowercase
+ // string, so we do this conversion ourselves, before examining
+ // it (and we also remove all non-ASCII characters)
+ key = String(key).toLowerCase().replace(/[^a-z]/g, '');
+ if (!initialConfig.escapeHTML ||
+ (!key.startsWith('on') && !key.includes('href'))) {
+ // setAttribute is an injection sink, so we need to filter
+ // out HTML event handler attributes and href (which is
+ // specifically sanitized above) to avoid XSS
+ a.setAttribute(key, hs.attributes[key]);
+ } else {
+ console.log('Hot spot attribute skipped.');
+ }
}
} else {
a.target = '_blank';
Source: GitHub Commit
The patch implements proper filtering by converting attribute keys to lowercase, removing non-ASCII characters, and blocking any attributes that start with on (event handlers) or contain href when escapeHTML is enabled.
Detection Methods for CVE-2026-27210
Indicators of Compromise
- Unusual JSON configuration files containing on* attributes in hot spot definitions
- Web server logs showing requests for external or unexpected JSON configuration files
- Browser console errors or warnings related to blocked inline event handlers
- Reports of page content being replaced or modified unexpectedly on panorama viewer pages
Detection Strategies
- Implement Content Security Policy (CSP) monitoring to detect violations from inline event handler execution
- Review web application firewall (WAF) logs for requests containing suspicious attribute patterns in config file parameters
- Monitor for JavaScript errors originating from panorama viewer components
- Scan deployed Pannellum instances for versions prior to 2.5.7
Monitoring Recommendations
- Enable CSP reporting to capture policy violations that may indicate exploitation attempts
- Set up alerts for abnormal JavaScript execution patterns on pages hosting Pannellum
- Monitor for unauthorized modifications to panorama configuration files
- Implement file integrity monitoring on hosted JSON configuration files
How to Mitigate CVE-2026-27210
Immediate Actions Required
- Upgrade Pannellum to version 2.5.7 or later immediately
- Audit all JSON configuration files used with Pannellum for malicious attributes
- Implement Content-Security-Policy headers with script-src-attr 'none' as an interim measure
- Review server logs for potential exploitation attempts
Patch Information
The vulnerability has been fixed in Pannellum version 2.5.7. The patch implements proper filtering of attribute keys by:
- Converting keys to lowercase strings
- Removing all non-ASCII characters
- Blocking attributes that start with on (event handlers) when escapeHTML is enabled
- Blocking attributes containing href (which is separately sanitized)
For detailed patch information, refer to the GitHub Security Advisory and the security fix commit.
Workarounds
- Set the Content-Security-Policy header to include script-src-attr 'none' to block execution of inline event handlers
- Do not host pannellum.htm on a domain that shares cookies with user authentication systems
- Restrict access to the standalone viewer to trusted users only
- Validate and sanitize all JSON configuration files before use
# Configuration example - Add CSP header to nginx
# Add to your nginx server block
add_header Content-Security-Policy "script-src-attr 'none'; default-src 'self';" always;
# For Apache, add to .htaccess or httpd.conf
# Header always set Content-Security-Policy "script-src-attr 'none'; default-src 'self';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
