Executive brief
uPlot is a high-performance library used to create charts and data visualizations in web applications. A security flaw in how the library merges data objects allows an attacker to inject malicious properties into the application's core JavaScript objects. This can lead to application instability, data tampering, or unauthorized changes to how the application behaves for all users.
Technical details
A prototype pollution vulnerability exists in uPlot versions prior to 1.6.31. The root cause is located in the `uplot.assign` utility function, which fails to properly sanitize or check keys such as `__proto__` when merging objects. A remote attacker can exploit this by providing a specially crafted JSON object containing these "magic" keys. If the application processes this untrusted input through the vulnerable function, the attacker can modify the global `Object.prototype`. This can result in property injection, denial of service through triggered exceptions, or potentially remote code execution depending on how the polluted properties are used elsewhere in the application environment. The issue is fixed in version 1.6.31.
Affected products
- leeoniya uplot < 1.6.31
Timeline
- 2024-01-28: disclosed: Vulnerability disclosed to vendor
- 2024-10-01: advisory: GitHub Advisory and Snyk advisory published
- 2024-10-01: patched: Fix released in version 1.6.31