PT-2026-21004 · Pannellum · Pannellum

Luminary + 2 · Published 2026-02-19 · Updated 2026-03-24 · CVE-2026-27210

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pannellum versions 2.5.6 through 3.5.0

Description Pannellum, a lightweight panorama viewer for the web, has an issue where the hot spot attributes configuration property allows setting any attribute, including HTML event handler attributes. This can lead to potential cross-site scripting (XSS) attacks. This impacts websites hosting the standalone viewer HTML file and any use of untrusted JSON config files, bypassing the escapeHTML parameter's protections. Certain events trigger without user interaction, meaning visiting a URL pointing to a malicious config file can execute arbitrary JavaScript code, potentially replacing page content. Reports indicate this issue is actively exploited for cryptocurrency-related phishing attempts. The attributes property is the source of the issue.

Recommendations Pannellum versions 2.5.6 through 3.5.0 should be updated to version 2.5.7 or later. As a workaround, set the Content-Security-Policy header to script-src-attr 'none' to block execution of inline event handlers. Do not host pannellum.htm on a domain that shares cookies with user authentication to reduce the risk of XSS.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27210

GHSA-8423-W5WX-H2R6

Affected Products

Pannellum

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27210.json · Exploit
• https://github.com/mpetroff/pannellum/security/advisories/GHSA-8423-w5wx-h2r6 · Vendor Advisory
• https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27210 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27210 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8423-w5wx-h2r6 · Vendor Advisory
• https://github.com/mpetroff/pannellum · Note
• https://twitter.com/CVEnew/status/2025154188590583814 · Twitter Post
• https://twitter.com/Infoblox/status/2036470000832356501 · Twitter Post
• https://twitter.com/petroffm/status/2024642051422212233 · Twitter Post
• https://t.me/cveNotify/152699 · Telegram Post
• https://t.me/CVEtracker/45352 · Telegram Post