plotly vulnerabilities

Products

• plotly/plotly.js 2
• dash 1
• plotly.js graphing 1

Latest plotly CVEs

Newest publication first

1. CVE-2026-55810 Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

   Published 2026-07-10

   High·CVSS 8.1 EPSS 0.43%

   Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

2. CVE-2024-21485 Dash apps vulnerable to Cross-site Scripting

   Published 2024-02-02

   Medium·CVSS 5.4 EPSS 1.5%

   Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16...

3. CVE-2023-46308 plotly.js prototype pollution vulnerability

   Published 2024-01-03

   Critical·CVSS 9.8 EPSS 0.94%

   In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.

4. CVE-2017-1000006 Cross Site Scripting (XSS) in plotly.js

   Published 2017-07-13

   Medium·CVSS 6.1 EPSS 0.88%

   Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.