Skip to content
Sign in
7.3 High

CVE-2020-28480 The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath…

Description

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

Affected products and versions

Product Affected versions Fixed in
jointjs 3.3 earliest → < 3.3.0 3.3.0

Other CVEs of jointjs

The 3 CVEs of jointjs →
CVE-2021-23444 This affects the package jointjs before 3.4.2 5.6 Medium CVE-2020-28479 The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function 5.9 Medium
Track this CVE