What is GHSA-34q8-jcq6-mc37?

GHSA-34q8-jcq6-mc37 is a security advisory published by GitHub Security Advisories with High severity. uPlot Prototype Pollution vulnerability

Which CVE IDs does GHSA-34q8-jcq6-mc37 cover?

GHSA-34q8-jcq6-mc37 covers the following CVE IDs: CVE-2024-21489. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34q8-jcq6-mc37?

GHSA-34q8-jcq6-mc37 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-34q8-jcq6-mc37?

GHSA-34q8-jcq6-mc37 affects 1 product, including: npm/uplot:\u003c 1.6.31.

GHSA-34q8-jcq6-mc37HighCVSS 8.2

uPlot Prototype Pollution vulnerability

Vendor

GitHub Security Advisories

Published

October 1, 2024

Last Modified

October 1, 2024

🔗 CVE IDs covered (1)

CVE-2024-21489 →

📋 Description

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

🎯 Affected products1

npm/uplot:< 1.6.31

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-21489
https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983
https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224
https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js#L437-L452
https://github.com/advisories/GHSA-34q8-jcq6-mc37