plotly/plotly.js vulnerabilities

Latest plotly/plotly.js CVEs

Newest publication first

1. CVE-2023-46308 plotly.js prototype pollution vulnerability

   Published 2024-01-03

   Critical·CVSS 9.8 EPSS 0.94%

   In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.

2. CVE-2017-1000006 Cross Site Scripting (XSS) in plotly.js

   Published 2017-07-13

   Medium·CVSS 6.1 EPSS 0.88%

   Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.