TI-2020-17294 Aliases CVE-2020-28487 GHSA-9mrv-456v-pf22

Cross-site scripting (XSS) in vis-timeline

LOW 33CWE-79Published 2021-01-22 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

Why it matters now

EPSS 0.01462 73rd percentileScored 2026-11-07

Fix Fixed vis-timeline: 7.4.4vis-timeline (npm): 7.4.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	vis-timeline	before 7.4.4	7.4.4	Patch available	CNA
—	vis-timeline (npm)	before 7.4.4	7.4.4	Patch available	GHSA-9mrv-456v-pf22

vis-timeline Vendor— Affected before 7.4.4 Fixed in 7.4.4 Patch available CNA
vis-timeline (npm) Vendor— Affected before 7.4.4 Fixed in 7.4.4 Patch available GHSA-9mrv-456v-pf22

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:visjs:vis-timeline::::::node.js::*	before 7.4.4	Vulnerable	Visjs

cpe:2.3:a:visjs:vis-timeline:*:*:*:*:*:node.js:*:* Versions before 7.4.4 Vulnerable ·Visjs

Remediation

Fix · CNA vis-timeline Fixed in 7.4.4
Fix · GHSA-9mrv-456v-pf22 vis-timeline (npm) Fixed in 7.4.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-28487
2026-10-03 Alias added: GHSA-9mrv-456v-pf22

References

Patch 1

https://github.com/visjs/vis-timeline/pull/840

Advisory 2

Other 1

https://github.com/visjs/vis-timeline/commit/a7ca349c7b3b6080efd05776ac77bb27176d4d3f

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences