Vulnerabilities

TI-2026-40291 CVE-2026-55810 · GHSA-gr6q-5p85-fq4q

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

LOW 38

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00433 Published 2026-07-10 Fixed in 3.0.2 CWE-915

TI-2024-14244 CVE-2024-21485 · GHSA-547x-748v-vp6p

Cross-site scripting in dash-core-components

MEDIUM 62

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.01487 Published 2024-02-02 Fixed in 2.13.0, 2.0.0 +2 CWE-79

TI-2023-24922 CVE-2023-46308 · GHSA-wjc4-73q6-gv3m

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted…

MEDIUM 51

In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00936 Published 2024-01-03 Fixed in 2.25.2 CWE-1321

TI-2017-14353 CVE-2017-1000006 · GHSA-2fqv-h3r5-m4vf

Plotly, Inc.

LOW 29

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00878 Published 2017-07-13 Fixed in 1.16.0 CWE-79

Vulnerabilities

Filters

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Cross-site scripting in dash-core-components

In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted…

Plotly, Inc.

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted…