uPlot Prototype Pollution vulnerability
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-21489US | — | — | ||
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototy… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/leeoniya/uPlotPACKAGE
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452WEB
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-21489ADVISORY
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan