GHSA-34q8-jcq6-mc37
uPlot Prototype Pollution vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-21489
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Description
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · uplot | introduced 0, fixed 1.6.31 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2024-21489 ADVISORY
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983 WEB
- https://github.com/leeoniya/uPlot PACKAGE
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452 WEB
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |