Homepage

org.webjars.bower:plotly.js@1.12.0 vulnerabilities

  • latest version

    2.33.0

  • latest non vulnerable version

    2.33.0

  • first published

    9 years ago

  • latest version published

    6 months ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.bower:plotly.js package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Prototype Pollution

    org.webjars.bower:plotly.js is a package that provides an easy and simple way to export package.json data.

    Affected versions of this package are vulnerable to Prototype Pollution via the expandObjectPaths or nestedProperty functions. An attacker can manipulate the prototype of base objects by injecting properties into existing JavaScript objects.

    How to fix Prototype Pollution?

    Upgrade org.webjars.bower:plotly.js to version 2.33.0 or higher.

    [,2.33.0)
    • M
    Cross-site Scripting (XSS)

    org.webjars.bower:plotly.js is a package that provides an easy and simple way to export package.json data.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS).

    How to fix Cross-site Scripting (XSS)?

    Upgrade org.webjars.bower:plotly.js to version 1.10.4, 1.16.0 or higher.

    [,1.10.4)[1.11.0,1.16.0)
    • M
    Cross-site Scripting (XSS)

    plotly.js is a high-level, declarative charting library.

    Affected versions of the package allow attackers to trick an unsuspecting user into viewing a specially crafted plot on a site that uses plotly.js. The vulnerability would have allowed the attacker to retrieve authentication tokens and perform actions on behalf of the user.

    plot.ly is rendering SVG objects inside the DOM. href tags are converted to the xlink:href attriubute on the <a> tag. This allowed an attacker to break out into the DOM and inject a payload.

    For more information, see Jared's post explaining the issue very well.

    How to fix Cross-site Scripting (XSS)?

    Upgrade to plotly.js version 1.16.0 or newer.

    [1.10.4,1.16.0)
    • L
    CSS Injection

    plotly.js is a high-level, declarative charting library.

    Affected versions of the package allowed the style attribute to be manipulated in the tag inside the embedded svg making them vulnerable to a css injection which allowed for tracking images to be embedded and leak information to an external domain.

    How to fix CSS Injection?

    Upgrade to plotly.js version 1.16.0 or newer.

    [,1.16.0)
    Go back to all versions of this package