Cross Site Scripting (XSS) in plotly.js (GHSA-2fqv-h3r5-m4vf)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2017-1000006
Severity: MODERATE · CWE: CWE-79

Affected versions of `plotly.js` are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.


## Recommendation

Update to 1.16.0 or later.

Affected packages:
package: ecosystem: npm
name: plotly.js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.16.0