Which versions of uPlot are affected by CVE-2024-21489?

uPlot charting library (versions before 1.6.31) can be compromised by attackers through crafted data inputs to corrupt application memory and shared state; publicly available exploit code exists.. A patch is available.

How to fix or mitigate CVE-2024-21489?

Within 24 hours, audit all applications and services to identify those using uPlot and confirm which versions are deployed. Within 7 days, prepare and deploy uPlot 1.6.31 or later across all environments after testing in staging to confirm charting functionality remains intact. Within 30 days, complete full production rollout across all applications, verify version compliance through dependency scanning, and document remediation completion for audit and compliance records.

uPlot CVE-2024-21489

Q: What is the CVSS score of CVE-2024-21489?

CVE-2024-21489 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2024-10-01 report@snyk.io

Information Disclosure Prototype Pollution

7.8

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

AC:H because exploitation requires attacker data to reach uplot.assign(), dependent on application architecture, not inherent to the library endpoint itself.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 16:30 vuln.today

Analysis Updated

Aug 10, 2026 - 16:30 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 16:22 NVD

8.2 (HIGH) 7.8 (HIGH)

CVE Published

Oct 01, 2024 - 05:15 cve.org

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 npm packages depend on uplot (8 direct, 12 indirect)

Ecosystem-wide dependent count for version 1.6.31.

DescriptionCVE.org

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

AnalysisAI

Prototype Pollution in the uPlot JavaScript charting library (versions before 1.6.31) allows an attacker who can supply crafted object data to the internal uplot.assign or copy functions to modify Object.prototype, corrupting shared state across the entire JavaScript runtime. All three distribution formats (CJS, ESM, IIFE) were affected identically, as confirmed by the fix commit 5756e3e which adds __proto__ key guards to both functions in each bundle. A proof-of-concept is confirmed by the E:P modifier in the provided CVSS 4.0 vector; no confirmed active exploitation (not in CISA KEV). EPSS of 0.63% (46th percentile) reflects realistic but low mass-exploitation probability.

Technical ContextAI

uPlot is a lightweight JavaScript time-series charting library distributed via npm. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes): the internal assign() function iterates over all keys of a source object using for...in and recursively calls copy() without checking whether any key equals __proto__. In JavaScript, assigning to obj['__proto__'] does not add a property to obj; it replaces the prototype of obj, propagating any injected properties to every subsequent object instantiated in the runtime. The fix (commit 5756e3e9b91270b303157e14bd0174311047d983) introduces a constant const __proto__ = "__proto__" and guards both copy() and assign() with if (k != __proto__) checks. The Java WebJars wrapper (SNYK-JAVA-ORGWEBJARSNPM-8163085) bundles the affected JS and is independently vulnerable. No CPE strings were provided in the input data.

Affected ProductsAI

The uPlot npm package in all versions before 1.6.31 is affected across all distribution formats: uPlot.cjs.js (CommonJS), uPlot.esm.js (ES Module), uPlot.iife.js, and uPlot.iife.min.js. The Java WebJars wrapper org.webjars.npm:uplot is also affected as documented at SNYK-JAVA-ORGWEBJARSNPM-8163085. No CPE strings were provided in the input. The fix is confirmed in commit 5756e3e9b91270b303157e14bd0174311047d983; the patched release version is 1.6.31 per Snyk advisory SNYK-JS-UPLOT-6209224.

RemediationAI

Upgrade the uPlot npm package to version 1.6.31 or later, which contains the fix from commit 5756e3e9b91270b303157e14bd0174311047d983. Java projects using the WebJars wrapper should upgrade to the corresponding patched org.webjars.npm:uplot version. Advisory details are available at https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224 and https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8163085. If an immediate upgrade is not possible, the primary compensating control is to ensure no untrusted user-supplied JSON is passed as chart configuration options to uPlot - sanitize or schema-validate all chart option objects server-side before they reach the uPlot API. This control trades off feature flexibility but eliminates the attack surface without modifying the library.