2017/10/GHSA-2fqv-h3r5-m4vf Cross Site Scripting (XSS) in plotly.js