PT-2024-13352 · Plotly · Plotly.Js

Published 2024-01-02 · Updated 2025-12-24 · CVE-2023-46308

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plotly plotly.js versions prior to 2.25.2

Description The issue concerns plot API calls having a risk of proto being polluted in expandObjectPaths or nestedProperty. This could potentially lead to security issues, although specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For versions prior to 2.25.2, update to version 2.25.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the expandObjectPaths and nestedProperty functions until a patch is applied. Avoid using these functions in plot API calls until the issue is resolved.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-46308

GHSA-WJC4-73Q6-GV3M

OPENSUSE-SU-2024:13607-1

RSEC-2025-1

Affected Products

Plotly.Js

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2023-46308 · Security Note
• https://osv.dev/vulnerability/GHSA-wjc4-73q6-gv3m · Vendor Advisory
• https://osv.dev/vulnerability/RSEC-2025-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46308 · Vendor Advisory
• https://github.com/plotly/plotly.js/releases/tag/v2.25.2 · Note
• https://github.com/plotly/plotly.js · Note
• https://github.com/plotly/plotly.js/commit/5efd2a1f07a418b230a5626fc6c1c7929c47949d · Note
• https://github.com/plotly/plotly.js/commit/02498404c8ad7a3395191e65694fb142a37b0fe9 · Note
• https://github.com/plotly/plotly.R/issues/2463 · Note
• https://github.com/plotly/plotly.R/pull/2471 · Note
• https://plotly.com/javascript · Note
• https://twitter.com/VulmonFeeds/status/1742435047481733486 · Twitter Post
• https://t.me/cibsecurity/74274 · Telegram Post
• https://t.me/cvenotify/66020 · Telegram Post
• https://twitter.com/CVEnew/status/1742408605775634695 · Twitter Post