Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zNHE4LWpjcTYtbWMzN84AA_4i
uPlot Prototype Pollution vulnerability
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Permalink: https://github.com/advisories/GHSA-34q8-jcq6-mc37JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNHE4LWpjcTYtbWMzN84AA_4i
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 days ago
Updated: 12 days ago
CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Identifiers: GHSA-34q8-jcq6-mc37, CVE-2024-21489
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-21489
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452
- https://github.com/advisories/GHSA-34q8-jcq6-mc37
Blast Radius: 30.0
Affected Packages
npm:uplot
Dependent packages: 40Dependent repositories: 4,578
Downloads: 408,141 last month
Affected Version Ranges: < 1.6.31
Fixed in: 1.6.31
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.30
All unaffected versions: 1.6.31