CVE-2020-28478

This affects the package gsap before 3.6.0.