CVE-2023-46308
plotly.js prototype pollution vulnerability
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
CVE-2023-46308- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
CVE-2023-46308- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2024-0449
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
EUVD-2024-0449- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wjc4-73q6-gv3m
plotly.js prototype pollution vulnerability
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
GHSA-wjc4-73q6-gv3m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
CVE-2023-46308- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-wjc4-73q6-gv3m
plotly.js prototype pollution vulnerability
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
GHSA-wjc4-73q6-gv3m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13607-1 No score
jupyter-panel-1.3.7-1.1 on GA media
These are all security issues fixed in the jupyter-panel-1.3.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13607-1- Updated
- 2026-11-02
OSVRSEC-2025-1 No score
Risk of __proto__ pollution Vulnerability
The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of proto being polluted in expandObjectPaths or nestedProperty.
- Record
RSEC-2025-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plotly/plotly.jsPackagist |
before 2.25.2 | 2.25.2 |
plotly.jsnpm |
before 2.25.2 | 2.25.2 |
plotly/plotly.jsPackagist |
before 2.25.2, plus listed versions v1.23.2v1.24.0v1.24.1v1.24.2v1.25.0 Show 45 moreShow lessv1.25.1v1.25.2v1.26.0v1.26.1v1.27.0v1.27.1v1.28.0v1.28.1v1.28.2v1.28.3v1.29.0v1.29.1v1.29.2v1.29.3v1.30.0v1.30.1v1.31.0v1.31.1v1.31.2v1.32.0v1.33.0v1.33.1v1.34.0v1.35.0v1.35.1v1.35.2v1.36.0v1.36.1v1.37.0v1.37.1v1.38.0v1.38.1v1.38.2v1.38.3v1.39.0v1.39.1v1.39.2v1.39.3v1.39.4v1.40.0v1.40.1v1.41.0v1.41.1v1.41.2v1.41.3 |
2.25.2 |
plotlyCRAN |
2.0.2 up to 4.12.0, plus listed versions 2.0.32.0.163.4.13.4.133.6.0 Show 20 moreShow less4.5.24.5.64.6.04.7.04.7.14.8.04.9.04.9.14.9.24.9.2.14.9.2.24.9.34.9.44.9.4.14.10.04.10.14.10.24.10.34.10.44.11.0 |
4.12.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46308 is a critical vulnerability (CVSS 9.8) in Plotly Plotly.js, published January 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 60th percentile. Fixed in plotly/plotly.js 2.25.2.
References
Left out here: 130 versions. The JSON record has them.