CVE-2017-1000006

Advisory

Plotly 1.12.6 includes Plotly.js v1.16.2, which fixes a potential XSS vulnerability in 'text' fields.
https://github.com/plotly/plotly.js/pull/736
https://plotly.com/chart-studio-help/security-advisories/2016-08-08-plotlyjs-xss-advisory/

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fixed
- Scattergeo and choropleth now correctly fire hover and click events [215]
- Heatmap and contour traces are redrawn in the correct order [194]
- Early returns in `Plotly.plot` now correctly return Promise rejections [226]
- Soon to be deprecated `SVGElement.offsetParent` calls are removed [222]
- Geo zoom in button is now correctly titled `Zoom in` [219]
- All attribute description are correctly stripped from the dist files (bug
introduced in 1.5.0) [223]
- Insecure dev dependencies `ecstatic` and `uglify-js` are bumped [225]
- Outdated karma-browserify dev dependency is bumped [229]

Resources

• https://pypi.org/project/plotly
• https://pyup.io/changelogs/plotly/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000006