GHSA-34q8-jcq6-mc37
uPlot Prototype Pollution vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-21489
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Description
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Affected packages
| Package | Versions |
|---|---|
| npm · uplot | introduced 0, fixed 1.6.31 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21489 ADVISORY
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983 WEB
- https://github.com/leeoniya/uPlot PACKAGE
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452 WEB
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |