Visioweb.js

30 Jul 2026 - Victor Pasman

During a penetration test, a client-side prototype pollution vulnerability was discovered in the Visioweb.js library, developed by Visio Globe. The vulnerability occurs in the getURLParameters function and, when combined with a gadget elsewhere in the application, can lead to DOM-based cross-site scripting (XSS).

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVE to the vulnerability included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerability.

Client-side prototype pollution leading to DOM-XSS - CVE-2022-3901

Technical write-up

Prototypes are the mechanism by which JavaScript objects inherit features from one another. Each object has a prototype, which can be accessed using the __proto__ parameter. This prototype contains fields and functions that are accessible from the object itself so if a parameter is not overridden on the object itself, the value from the prototype is used instead.

If the prototype of an object can be changed (“polluted”) by user-controlled input, this is called a prototype pollution vulnerability.

Client-side prototype pollution is not, on its own, a vulnerability with direct impact. However, when paired with a “gadget” any piece of JavaScript that evaluates the user-controlled prototype value or inserts it unsafely into the DOM — it can lead to vulnerabilities such as DOM-based XSS or open redirection, potentially allowing an attacker to control JavaScript execution on the page. The affected code path is the getURLParameters function, which parses URL parameters without adequately guarding against prototype pollution. This function is part of the mapviewer-uikit code that ships as an integral component of the Visioweb distribution — it is not an optional, standalone sample that a consumer would typically strip out. For that reason the issue is treated as affecting the product itself, across all versions up to and including 1.10.6, rather than being scoped to a detached demo. The behaviour was reproduced against the mapviewer-uikit code shipped in the ZIP package for VisioWeb 1.10.6. To keep the impact assessment precise, it is worth separating what was directly demonstrated from what is conditional:

What was demonstrated. A proof-of-concept payload targeting getURLParameters confirmed the prototype pollution primitive: by supplying a crafted URL, arbitrary properties on JavaScript objects used by the page could be overwritten. This is the finding that was actually reproduced during the engagement.

What is conditional. Prototype pollution by itself does not execute attacker-controlled script. Escalation to DOM-based XSS (or open redirection) requires a suitable gadget — downstream code that reads the polluted value and passes it into a dangerous sink (the DOM or a JavaScript execution context). Whether that escalation is reachable depends on the specific gadgets present in a given application built on top of Visioweb, and a full end-to-end XSS chain was not demonstrated in this write-up. The CVE reflects the realistic worst case (DOM-XSS), because a polluted prototype can influence other components on the same page. Consumers should therefore treat the confirmed prototype pollution as the concrete defect, and the DOM-XSS as the escalation it enables wherever a matching gadget exists in their own code.

Suggested actions

Timeline

{timeline from casefile — not provided in the source documents; please fill in reservation/disclosure/publication dates}

More information

Last modified: 30 Jul 2026 20:12 CEST