CVE-2020-28487: 
JavaScript vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in vis-timeline before version 7.4.4. The vulnerability was assigned CVE-2020-28487 and was disclosed on December 25, 2020. The vulnerability affects the Timeline element where an attacker with the ability to control the items can inject additional script code into the generated application (Snyk).

The vulnerability is classified as a medium severity issue with a CVSS base score of 6.8. The attack requires network access, low attack complexity, low privileges, and user interaction. The vulnerability allows an attacker to potentially achieve high confidentiality impact with low integrity and availability impacts. The vulnerability is related to improper neutralization of input during web page generation (CWE-79) (NVD).

If exploited, this vulnerability could allow attackers to inject malicious JavaScript code that executes in the context of the user's browser. This could potentially lead to theft of session cookies, hijacking of user sessions, exposure of sensitive information, and access to privileged services and functionality (Snyk).

A proof-of-concept exploit exists demonstrating how an attacker can inject malicious code through the Timeline element's content property. The exploit involves inserting HTML img tags with malicious onerror JavaScript handlers (Snyk).

The vulnerability was fixed in version 7.4.4 of vis-timeline. Users are recommended to upgrade to this version or later to address the security issue. The fix involved adding the XSS library to improve security (GitHub PR).

The vulnerability was initially reported through a GitHub issue (#838) and subsequently fixed through pull request #840. The fix was released in version 7.4.4 on December 20, 2020. Some developers raised concerns about the fix being a breaking change due to its strict sanitization approach (GitHub PR).