← back
CVE-2024-21489highCWE-1321

CVE-2024-21489

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.7%
exploitation probability
0.7%top 48% of all CVEs
observed exploitation
nono source reports it
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
n/a · org.webjars.npm:uplotn/a · uplot
References
https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8163085https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224