plotly.js (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package plotly.js, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2023-46308 — CVSS 9.8 (critical): In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
• CVE-2017-1000006 — CVSS 6.1 (medium): Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.