NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function.
CVSS 3.0HIGH 8.8·Network·No auth·User interaction·EPSS 0.01005·Published 2018-03-13·Fixed in 1.3.2CWE-352