CVE-2017-1000043: Mapbox Mapbox.js

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control

Affected products

• Mapbox Mapbox.js: from 1.0.0, before 1.6.6 (fixed in 1.6.6); from 2.0.0, before 2.2.4 (fixed in 2.2.4)

Published 2017-07-17. Last modified 2026-06-17.