GHSA-qwp9-52h8-xgg8

Suggest an improvement
Source
https://github.com/advisories/GHSA-qwp9-52h8-xgg8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-qwp9-52h8-xgg8/GHSA-qwp9-52h8-xgg8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qwp9-52h8-xgg8
Aliases
Published
2021-01-20T21:21:16Z
Modified
2025-01-08T07:27:12.307652Z
Summary
Prototype pollution in JointJS
Details

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed_at": "2021-01-20T05:24:47Z",
    "github_reviewed": true,
    "nvd_published_at": "2021-01-19T15:15:00Z",
    "severity": "HIGH"
}
References

Affected packages

npm / jointjs

Package

Name
jointjs
View open source insights on deps.dev
Purl
pkg:npm/jointjs

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/01/GHSA-qwp9-52h8-xgg8/GHSA-qwp9-52h8-xgg8.json"