GitHub Advisoryadvisory · npm

GHSA-qwp9-52h8-xgg8 Prototype pollution in JointJS

HIGH Published 2021-01-20 Modified 2021-01-20 Official page ↗
Aliases
CVE-2020-28480
Ecosystem
npm
Packages
jointjs
Severity
High
Weaknesses
CWE-400
Reviewed
2021-01-20

Affected packages

• npm jointjs: < 3.3.0 → fixed in 3.3.0

Description

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

Related

Alias · CVE (1)

  • CVE-2020-28480 The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References