search

fusioncharts / fusioncharts-dist

FusionCharts JavaScript Charting library. Over 95+ charts and 1,400+ maps to choose from, with integrations available for all popular JavaScript frameworks & back-end programming languages.
https://www.fusioncharts.com
Other
84 stars 46 forks source link

RamdaJs, a dependency of fusioncharts 3.19.0, has a known critical vulnerability #54

Open leon0leon opened 1 year ago

leon0leon commented 1 year ago

image image image

RamdaJs 0.25.0 is a dependency of fusioncharts 3.19.0. It has 1 known critical vulnerability: DISPUTED Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "proto") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes.

liam-lian-01 commented 1 year ago

I have a same issue. Scan with BlackDuck. image