CVSS 4.0
7.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:PCVE-2024-21489
High (7.8). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in uplot 1.6.31.
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
Severity
CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-34q8-jcq6-mc37 | npm | uplot | <1.6.31 | 1.6.31 |