GHSA-34q8-jcq6-mc37

uPlot Prototype Pollution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-21489

Packages

Ecosystem	Package	Affected	Fixed in
npm	uplot	< 1.6.31	1.6.31

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21489 advisory
https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983 web
https://github.com/leeoniya/uPlot package
https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452 web
https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224 web