{"id":"GHSA-7vvq-7r29-5vg3","summary":"Cross site scripting in three.js","details":"# CVE has been withdrawn\n\nVersions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.\n\n","aliases":["CVE-2022-0177"],"modified":"2026-09-10T03:49:10.673141292Z","published":"2022-01-27T16:00:48Z","withdrawn":"2022-01-28T18:32:01Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-01-25T21:13:47Z","nvd_published_at":"2022-01-24T21:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0177"},{"type":"WEB","url":"https://github.com/mrdoob/three.js/pull/23245"},{"type":"WEB","url":"https://github.com/mrdoob/three.js/commit/0c31bc605e21965aad8a6479bb1969351773f76d"},{"type":"PACKAGE","url":"https://github.com/mrdoob/three.js"},{"type":"WEB","url":"https://huntr.dev/bounties/16901080-99b4-4fb5-8c5b-931bfbf33cba"}],"affected":[{"package":{"name":"three","ecosystem":"npm","purl":"pkg:npm/three"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.137.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-7vvq-7r29-5vg3/GHSA-7vvq-7r29-5vg3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"}]}