CVE-2020-28487

Name of the Vulnerable Software and Affected Versions: vis-timeline versions prior to 7.4.4

Description: The issue allows an attacker with the ability to control the items of a Timeline element to inject additional script code into the generated application. This can be done by exploiting the vulnerability in the vis-timeline package.

Recommendations: For vis-timeline versions prior to 7.4.4, update to version 7.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Timeline element to minimize the risk of exploitation. Avoid using the vis-timeline package until the issue is resolved.