CVE-2023-46308: plotly.js prototype pollution vulnerability

critical Affects plotly/plotly.js. Feed 2026.10.29.1, updated 2026-10-28; published 2024-01-03; advisory modified 2025-12-26.

plotly.js prototype pollution vulnerability

Package: plotly/plotly.js Composer
Affected versions: <2.25.2
Fixed in: 2.25.2
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 1% (60.7th percentile)
Published: 2024-01-03
Source: osv.dev

References

CWE-1321

NVD record plotly/plotly.js advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2019-11358 medium XSS in jQuery as used in Drupal, Backdrop CMS, and other products same weakness: CWE-1321
CVE-2018-6195 high admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-im same weakness: CWE-1321
CVE-2018-19296 high Phar object injection in PHPMailer same weakness: CWE-1321
CVE-2021-23682 critical Prototype Pollution in litespeed.js and appwrite/server-ce same weakness: CWE-1321
CVE-2020-11066 high Class destructors causing side-effects when being unserialized in TYPO3 CMS same weakness: CWE-1321
CVE-2022-39357 high Prototype pollution in Snowboard framework same weakness: CWE-1321