plotly.js prototype pollution vulnerability

严重 9.8CVE-2023-46308 · GHSA-wjc4-73q6-gv3m · Published 03/01/2024 · updated 17/06/2026

要点

CVE-2023-46308 是影响 plotly/plotly.js, plotly.js (plotly), plotly.js 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.94%，高于 61.0% 的漏洞。
修复：升级到 2.25.2 或更高版本。

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.

NVD description

In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.