CVE-2024-21489

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-21489
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21489.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-21489
Aliases
Downstream
Published
2024-10-01T05:00:02.644Z
Modified
2026-07-15T01:49:14.024383118Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21489.json",
    "cwe_ids": [
        "CWE-1321"
    ],
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/leeoniya/uplot

Affected ranges

Type
GIT
Repo
https://github.com/leeoniya/uplot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f98d1d34d92a128f18fbaac9293910eed85ea19c
Fixed
5756e3e9b91270b303157e14bd0174311047d983
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.31"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.10
1.0.11
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.15
1.6.16
1.6.17
1.6.18
1.6.19
1.6.2
1.6.20
1.6.21
1.6.22
1.6.23
1.6.24
1.6.25
1.6.26
1.6.27
1.6.28
1.6.29
1.6.3
1.6.30
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21489.json"