# CVE-2020-28480: JointJS prototype pollution in util.setByPath

Source: https://junglewise.ai/threats/cve-2020-28480-jointjs-prototype-pollution-in-util-setbypath  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-01-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-28480 · Severity: info · CVSS 7.5 · Published 2021-01-20

JointJS is a JavaScript library used for creating interactive diagram and visualization applications. A prototype pollution vulnerability in the util.setByPath function could allow attackers to manipulate the behavior of affected applications by modifying core JavaScript object properties, potentially leading to denial of service or application compromise.

Technologies: [jointjs (npm)](https://junglewise.ai/threats/technologies/jointjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-28480 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28480 being exploited in the wild.

**How severe is CVE-2020-28480?** Informational severity, with a CVSS score of 7.5, published 20 January 2021.

**Which products and versions are affected?** jointjs (npm) SEMVER:introduced=0,fixed=3.3.0.

**Is there a fix for CVE-2020-28480?** Yes. jointjs (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28480 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-28480?** Check whether you run jointjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jointjs (npm): upgrade to 3.3.0 or later

  ```sh
  npm install jointjs@3.3.0
  ```


## Technical details

The vulnerability is a prototype pollution flaw in JointJS's util.setByPath function, where the path parameter used to access and set object keys is not properly sanitized. This allows an attacker to inject special keys like __proto__, constructor, or prototype to pollute the JavaScript prototype chain. The attack requires the ability to control input passed to util.setByPath, which may be reachable through application functionality that processes user-supplied data. Successful exploitation can modify global object properties, affecting all instances of affected objects and potentially causing denial of service or enabling further attacks. The vulnerability was fixed in version 3.3.0.

## Affected products

- JointJS JointJS before 3.3.0

## Identifiers

- CVE-2020-28480
- GHSA-qwp9-52h8-xgg8

## Timeline

- 2021-01-20: disclosed: Advisory published (GHSA-qwp9-52h8-xgg8)
- 3.3.0: patched: Fix released in version 3.3.0

## References

- [https://github.com/clientIO/joint/pull/1406](https://github.com/clientIO/joint/pull/1406)

## Related threats

- [JointJS prototype pollution in setByPath](https://junglewise.ai/threats/cve-2021-23444-jointjs-prototype-pollution-in-setbypath)
- [jointjs denial of service via unsetByPath](https://junglewise.ai/threats/cve-2020-28479-jointjs-denial-of-service-via-unsetbypath)