Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-46308 EUVD-2024-0449GHSA-wjc4-73q6-gv3m

plotly.js prototype pollution vulnerability

Published Jan 3, 2024 · Updated Dec 24, 2025 · Assigned by mitre

Package: plotly.js Package: plotly/plotly.js Ecosystem: npm Ecosystem: Packagist

Description

In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

Affected packages

EcosystemPackageAffectedFixedRecord
npm plotly.js < 2.25.2 2.25.2 GHSA-wjc4-73q6-gv3m
Packagist plotly/plotly.js < 2.25.2 2.25.2 GHSA-wjc4-73q6-gv3m

Advisories 1

References