Plotly Plotly.js — known CVE vulnerabilities

Every CVE whose affected-product data names Plotly Plotly.js, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2023-46308 — CVSS 9.8 (critical): In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
• CVE-2017-1000006 — CVSS 6.1 (medium): Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.