CVE-2017-1000042

Mapbox.js is affected by a cross-site scripting (XSS) vulnerability in TileJSON handling. Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable when untrusted TileJSON content is loaded via L.mapbox.map or L.mapbox.tileLayer from non-Mapbox URLs, allowing script injection in the TileJ...