Prototype Pollution

Vulnerability

The package jointjs before version 3.3.0 is vulnerable to Prototype Pollution through the util.setByPath function [1]. This function fails to properly sanitize the input path, allowing an attacker to set properties on the global Object prototype via __proto__, constructor, or prototype [3].

Exploitation

An attacker can exploit this by crafting a malicious path argument that includes __proto__, leading to pollution of Object.prototype [2]. No authentication is required if the application uses user-controlled input in the path parameter. The vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) [1].

Impact

Successful exploitation can result in denial of service (e.g., triggering JavaScript exceptions) or remote code execution by altering the application's code path [3][4]. All JavaScript objects inherit from the polluted prototype, potentially affecting application behavior globally.

Mitigation

Users should upgrade to jointjs version 3.3.0 or later, where the issue is fixed [2]. There is no known workaround; updating is the recommended mitigation [1].