plotly.js@1.3.1 vulnerabilities

The open source javascript graphing library that powers plotly

Known vulnerabilities in the plotly.js package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Prototype Pollution plotly.js is a package that provides an easy and simple way to export package.json data. Affected versions of this package are vulnerable to Prototype Pollution via the `expandObjectPaths` or `nestedProperty` functions. An attacker can manipulate the prototype of base objects by injecting properties into existing JavaScript objects. How to fix Prototype Pollution? Upgrade `plotly.js` to version 2.25.2 or higher.	<2.25.2
M Cross-site Scripting (XSS) plotly.js is a package that provides an easy and simple way to export package.json data. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). How to fix Cross-site Scripting (XSS)? Upgrade `plotly.js` to version 1.10.4, 1.16.0 or higher.	<1.10.4 >=1.11.0 <1.16.0
L CSS Injection `plotly.js` is a high-level, declarative charting library. Affected versions of the package allowed the style attribute to be manipulated in the tag inside the embedded `svg` making them vulnerable to a css injection which allowed for tracking images to be embedded and leak information to an external domain. How to fix CSS Injection? Upgrade to `plotly.js` version 1.16.0 or newer.	<1.16.0