Description
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | uplot | < 1.6.31 | 1.6.31 |
| — | org.webjars.npm:uplot | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.4 TUS | grafana | 7.3.6-7.el8_4 | RHSA-2024:8083 |
| RHEL 8.4 E4S | grafana | 7.3.6-7.el8_4 | RHSA-2024:8083 |
| RHEL 8.4 AUS | grafana | 7.3.6-7.el8_4 | RHSA-2024:8083 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | uplot | < 1.6.31 | 1.6.31 | GHSA-34q8-jcq6-mc37 |
Advisories 2
- RHSA-2024:8083 Red Hat Security Advisory: grafana security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- WID-SEC-2024-3179 Red Hat Enterprise Linux: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Oct 14, 2024
References
- https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8163085
- https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452
- https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983