Executive brief
Plotly.js is a popular data visualization library used to create interactive charts and graphs in web applications. A prototype pollution vulnerability in versions before 2.25.2 allows attackers to manipulate object properties through specially crafted API calls, potentially leading to unauthorized modification of application behavior, data tampering, or code execution.
Technical details
A prototype pollution vulnerability exists in Plotly.js affecting versions prior to 2.25.2, triggered through the expandObjectPaths or nestedProperty functions in plot API calls. The vulnerability allows unauthenticated network attackers with no user interaction required to pollute the Object prototype, gaining high impact on confidentiality, integrity, and availability. Attack vectors include malicious plot configurations passed to the Plotly API that traverse prototype chains. Patches are available in version 2.25.2 and later, and the vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
Affected products
- Plotly plotly.js before 2.25.2
Timeline
- 2024-01-03: disclosed
- 2024-01-03: patched: Fix released in version 2.25.2