Pannellum Zero Day
XSS on trusted domains

143 / A flaw in Pannellum 2.5.6 let attacker-controlled panorama configs run script on trusted domains. We trace the NPS and CNN examples, investigate urlscan.io and attacker infrastructure, and examine the risks of session theft and search cloaking, plus the fix in 2.5.7.

Timeline

00:00 Intro

00:19 A hacker's attention to detail

01:58 History.replaceState

03:59 Cross-site scripting

04:52 Search engine cloaking

06:08 Recorded demo

09:26 Collaborative investigation

10:13 This thing isn't going to hack itself

14:36 Following the attack infrastructure

15:18 Eval strings

20:50 Capture the flag techniques

26:37 Harmless proof of concept

28:41 Severity scoring

Participants

@fulldecent

William Entriken

Episode notes

Edit these notes…

The walkthrough follows a cross-site scripting issue in the standalone Pannellum panorama viewer, from the first suspicious search result to the vulnerable configuration handling and the upstream fix. The examples show how attacker-controlled content could appear under trusted NPS and CNN addresses without compromising those organizations’ web servers.

Attack chain

Pannellum’s standalone viewer accepted a remote JSON configuration. In affected versions, hotspot attributes could include HTML event handlers.
A crafted hotspot used an animation event to execute script without a click. The script replaced the page content and changed the visible path with history.replaceState.
The injected page could serve different content to search crawlers and human visitors. Reloading a changed path could then show a 404, making the incident harder to reproduce.
The impact ranges from search-result manipulation to phishing or session theft when a victim is authenticated on the affected domain. The show distinguishes those outcomes rather than treating every affected viewer as an account takeover.

Versions and remediation

The GitHub security advisory identifies Pannellum 2.5.0 through 2.5.6 as affected and 2.5.7 as fixed. The issue is CVE-2026-27210 / GHSA-8423-w5wx-h2r6.
The fix blocks event-handler attributes in hotspot configuration and requires same-origin JSON configuration for the standalone viewer. The advisory also describes Content Security Policy and cookie-domain isolation as mitigations.
The write-up identifies krpano in the CNN panorama example and notes that the viewer dates to 2014. It proposes investigating krpano 1.17-pr2 and 1.20.12 as follow-up leads; those versions are not established there as affected versions. krpano’s current release notes list 1.24.

Investigation and disclosure

Google search alerts surfaced the NPS result. The group then used urlscan.io and archived configuration listings to identify related infrastructure and other panorama viewers.
The discussion weighs SEO poisoning against direct account impact, explains crawler cloaking, and considers how attacker-controlled pages can mislead search and AI retrieval systems.
Infrastructure attribution remains uncertain: a server hosting malicious configuration may itself be compromised. The linked write-up documents a no-harm proof of concept and recommends updating Pannellum and monitoring for suspicious configuration requests.

Drinks

The non-alcoholic sparkling apple drink is Cawston Press Sparkling Cloudy Apple.
The pale ale shown is Fuzzy Baby Ducks, an IPA from New England Brewing Company.

Pannellum Zero Day XSS on trusted domains