CVE-2024-21489

State: Published
Severity: 8.8 High
Published: Oct 1, 2024
Updated: Aug 16, 2026
Reserved: Dec 22, 2023

Description

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P	snyk
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P	snyk

Weaknesses

CWE-1321 Prototype Pollution

Affected Products

Product	Versions
uplotn/a	before 1.6.31Affected
org.webjars.npm:uplotn/a	all versionsAffected

References

https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8163085
https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452
https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.