Platform
javascript
Component
cesium
Fixed in
1.137.1
A cross-site scripting (XSS) vulnerability exists in CesiumJS versions up to 1.137.0, specifically within the Apps/Sandcastle/standalone.html functionality. This flaw allows an attacker to manipulate the 'c' argument, potentially leading to the execution of malicious scripts within a user's browser. While the precise impact remains uncertain, the availability of a public exploit highlights the potential for immediate exploitation.
Successful exploitation of CVE-2026-3990 allows an attacker to inject arbitrary JavaScript code into the context of a user's browser session. This can lead to a wide range of malicious activities, including session hijacking, credential theft, and defacement of the CesiumJS application. Given the public availability of an exploit, attackers can readily leverage this vulnerability to compromise systems and steal sensitive information. The attack vector is remote, meaning an attacker does not need to be authenticated to exploit the vulnerability.
CVE-2026-3990 is linked to CVE-2023-48094, indicating a history of unresponsiveness from the vendor. A public proof-of-concept exploit is available, significantly increasing the risk of exploitation. The vulnerability was publicly disclosed on 2026-03-12. The EPSS score is likely Medium, given the public exploit and lack of vendor response.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-3990 is to upgrade to a patched version of CesiumJS. As of this writing, no patched version has been released. Until a fix is available, consider implementing input validation and sanitization on the 'c' argument within Apps/Sandcastle/standalone.html to prevent malicious code injection. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Carefully review and audit any third-party libraries or components integrated with CesiumJS to identify potential vulnerabilities.
Update CesiumJS to a version later than 1.137.0. If updating is not possible, review and filter the inputs of the 'c' argument in the file Apps/Sandcastle/standalone.html to prevent the execution of unwanted code.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-3990 is a cross-site scripting vulnerability in CesiumJS versions up to 1.137.0, allowing attackers to inject malicious scripts via the 'c' parameter in Apps/Sandcastle/standalone.html.
If you are using CesiumJS version 1.137 or earlier, you are potentially affected by this vulnerability. Assess your usage of Apps/Sandcastle/standalone.html.
Upgrade to a patched version of CesiumJS. As of this writing, no patched version is available. Implement input validation and sanitization as a temporary workaround.
Yes, a public proof-of-concept exploit exists, indicating a high likelihood of active exploitation.
The vendor has not released an official advisory. Refer to the CVE details and related security reports for more information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.