CVE-2023-46308: 
JavaScript vulnerability analysis and mitigation

A prototype pollution vulnerability was discovered in Plotly plotly.js versions before 2.25.2, affecting plot API calls in the expandObjectPaths or nestedProperty functions. The vulnerability was assigned CVE-2023-46308 and was disclosed in January 2024 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as prototype pollution. The vulnerability specifically affects the expandObjectPaths and nestedProperty functions when making plot API calls (NVD).

Given the CVSS score of 9.8, this vulnerability has critical severity with potential high impacts on confidentiality, integrity, and availability. The prototype pollution vulnerability could allow attackers to modify object prototype attributes, potentially leading to application-wide security issues (NVD).

The vulnerability is remotely exploitable without requiring authentication or user interaction. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability has been fixed in plotly.js version 2.25.2. Users are advised to upgrade to this version or later to mitigate the security risk (GitHub Release).