@convergence/jointjs-utils (>=0.1.0 <=0.6.0), @cronapp/tools (>=1.0.0-SNAPSHOT.4 <=1.0.0-SNAPSHOT.12) +36 more potentially affected by CVE-2021-23444 via jointjs (>=0.9.10 <=3.4.1)

jointjs NPM version =0.9.10, =0.1.0, =1.0.0-SNAPSHOT.4, =1.0.7, =1.5.2-3.1, =0.1.0, =0.1.3, =0.8.2, =1.5.30, =1.0.1, =1.0.0-alpha.1, =1.0.0, =0.0.3, =0.2.2 and more Source cves: CVE-2021-23444 Source advisory: OSV:GHSA-F3PP-32QC-36W4...

CVE-2021-23444 Prototype Pollution

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function...