Prototype pollution in JointJS

CRITICO 9.8CVE-2020-28480 · GHSA-qwp9-52h8-xgg8 · Published 19/01/2021 · updated 17/06/2026

In breve

CVE-2020-28480 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda jointjs (jointjs), jointjs.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 72.2% delle vulnerabilità.
Correzione: aggiornare a 3.3.0 o successiva.

Package	Affected versions	Patched versions
jointjs jointjs	`< 3.3.0`	`3.3.0`
jointjs npm	`< 3.3.0`	`3.3.0`

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

NVD description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 3.3.0

3.3.0

npm

< 3.3.0

3.3.0

Description

NVD description