Prototype pollution in JointJS

CRÍTICO 9.8CVE-2020-28480 · GHSA-qwp9-52h8-xgg8 · Published 19/01/2021 · updated 17/06/2026

En resumen

CVE-2020-28480 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a jointjs (jointjs), jointjs.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.2% de las vulnerabilidades.
Solución: actualizar a 3.3.0 o posterior.

Package	Affected versions	Patched versions
jointjs jointjs	`< 3.3.0`	`3.3.0`
jointjs npm	`< 3.3.0`	`3.3.0`

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

NVD description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 3.3.0

3.3.0

npm

< 3.3.0

3.3.0

Description

NVD description