~ / search / GHSA-f3pp-32qc-36w4

GHSA-f3pp-32qc-36w4

Prototype Pollution in jointjs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23444

Packages

EcosystemPackageAffectedFixed in
npm jointjs < 3.4.2 3.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

References

External links from the advisory. They lead to third-party sites.