The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
7.5CVSS
7.4AI Score
0.002EPSS
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.
9.8CVSS
9.2AI Score
0.003EPSS