GHSA-f3pp-32qc-36w4MediumCVSS 5.6

Prototype Pollution in jointjs

Published
September 22, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23444 →

📋 Description

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

🎯 Affected products1

  • npm/jointjs:< 3.4.2

🔗 References (7)