GHSA-qwp9-52h8-xgg8High

Prototype pollution in JointJS

Published
January 20, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-28480 →

📋 Description

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

🎯 Affected products1

  • npm/jointjs:< 3.3.0

🔗 References (7)