Description (CNA)
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / uplot | affected 0 before 1.6.31 |
| n/a / org.webjars.npm:uplot | affected 0 before * |
CWE
CWE-1321
References
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8163085
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983
ADP enrichment
No English description supplied.
No references supplied.