Skip to content
Sign in
5.6 Medium

CVE-2021-23444 This affects the package jointjs before 3.4.2

Description

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

Affected products and versions

Product Affected versions Fixed in
jointjs 3.4 earliest → < 3.4.2 3.4.2

Other CVEs of jointjs

The 3 CVEs of jointjs →
CVE-2020-28479 The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function 5.9 Medium CVE-2020-28480 The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath… 7.3 High
Track this CVE