sheetsee (>=0.0.1, <=0.0.3), sheetsee-maps (>=0.0.0, <=0.2.4) potentially affected by CVE-2017-1000043 via mapbox.js (1.3.1)

mapbox.js NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on mapbox.js and may be impacted: - sheetsee =0.0.1, =0.0.0, =0.2.4 Source cves: CVE-2017-1000043 Source advisory: OSV:GHSA-Q69P-5H74-W36F...

CVE-2017-1000043

The CVE refers to a cross-site scripting vulnerability in Mapbox.js. Affected versions are 1.x before 1.6.6 and 2.x before 2.2.4, where using L.mapbox.map or L.mapbox.shareControl with TileJSON content under user control can allow injection of script content into the TileJSON name field. After th...