@convergence/jointjs-utils (>=0.4.0, <=0.6.0), @cronapp/tools (>=1.0.0-SNAPSHOT.4, <=1.0.0-SNAPSHOT.12) +10 more potentially affected by CVE-2021-23444 via jointjs (>=3.1.0, <=3.4.1)

jointjs NPM version =3.1.0, =0.4.0, =1.0.0-SNAPSHOT.4, =1.5.2-3.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.2.0, =0.9.0, =0.12.0 - ublatt 1.2.0 - vue-erd 0.1.1 - vue-test-demo-one 0.1.0 Source cves: CVE-2021-23444 Source advisory: OSV:GHSA-F3PP-32QC-36W4...

CVE-2021-23444 Prototype Pollution

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function...

@convergence/jointjs-utils (>=0.4.0, <=0.6.0), @cronapp/tools (>=1.0.0-SNAPSHOT.4, <=1.0.0-SNAPSHOT.12) +10 more potentially affected by CVE-2020-28480 +1 more via jointjs (>=3.1.0, <=3.4.1)

jointjs NPM version =3.1.0, =0.4.0, =1.0.0-SNAPSHOT.4, =1.5.2-3.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.2.0, =0.9.0, =0.12.0 - ublatt 1.2.0 - vue-erd 0.1.1 - vue-test-demo-one 0.1.0 Source cves: CVE-2020-28480, CVE-2021-23444 Source advisory: SNYK:JS-JOINTJS-1579578...