CVE-2024-21489: uPlot Prototype Pollution Vulnerability

CVE-2024-21489 Overview

CVE-2024-21489 is a prototype pollution vulnerability affecting versions of the uplot JavaScript charting library before 1.6.31. The flaw resides in the uplot.assign function, which fails to verify whether a target attribute resolves to the object prototype before assignment. An attacker can supply crafted property names such as __proto__ to modify Object.prototype, affecting all objects in the running JavaScript context. The vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact
Successful exploitation allows attackers to pollute the JavaScript object prototype, leading to integrity compromise, application logic tampering, and potential denial of service in client-side applications using uPlot.

Affected Products

uplot npm package versions prior to 1.6.31
JavaScript applications embedding vulnerable uPlot builds for charting
Web dashboards and monitoring tools that bundle uPlot as a dependency

Discovery Timeline

2024-10-01 - CVE-2024-21489 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-21489

Vulnerability Analysis

uPlot is a small, fast JavaScript charting library used in many monitoring and analytics interfaces. The library exposes a utility function uplot.assign that performs a recursive merge of source objects into a target object. The function copies properties from attacker-influenced input without filtering reserved keys such as __proto__, constructor, or prototype.

When an application passes untrusted JSON or query parameters into uplot.assign, an attacker can inject a payload that walks the prototype chain. Writes performed against Object.prototype then propagate to every object in the runtime. This can corrupt configuration flags, override security-relevant defaults, and crash dependent code paths. The impact aligns with the CVSS integrity and availability subscores reported by the vendor.

Root Cause

The root cause is the absence of a key-name guard inside the recursive merge logic in src/utils.js. The function iterates source keys and assigns them into the target without checking whether the resulting reference is Object.prototype. Fixed builds add explicit checks that skip __proto__ and other prototype-resolving keys. See the GitHub commit history for the upstream patch and the GitHub uPlot utility code for the original vulnerable implementation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker delivers a crafted JSON object to any application surface that forwards user-controlled data into uplot.assign. Common entry points include chart configuration endpoints, dashboard import features, and URL parameters parsed into chart options. The polluted prototype then affects the entire JavaScript context, including security checks performed elsewhere in the application. Refer to the Snyk Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-21489

Indicators of Compromise

HTTP request bodies or query strings containing the literal strings __proto__, constructor.prototype, or prototype in JSON property positions.
Unexpected runtime errors referencing properties on built-in objects, such as TypeError exceptions for properties that were never explicitly set.
Client-side behavior changes after rendering charts, including overridden default options across unrelated components.

Detection Strategies

Inspect software composition analysis (SCA) results for uplot versions below 1.6.31 in package.json and lockfiles.
Add web application firewall (WAF) rules that flag JSON payloads containing prototype-related keys reaching chart and dashboard endpoints.
Enable client-side runtime monitoring for modifications to Object.prototype during application initialization.

Monitoring Recommendations

Log and alert on HTTP requests whose bodies include __proto__ or constructor keys to backend services that forward data to uPlot.
Track dependency drift in CI pipelines and fail builds when vulnerable uPlot versions are reintroduced.
Review browser console errors collected by real-user monitoring tools for anomalies that correlate with prototype tampering.

How to Mitigate CVE-2024-21489

Immediate Actions Required

Upgrade uplot to version 1.6.31 or later in all applications and rebuild affected bundles.
Audit application code for any path where untrusted input reaches uplot.assign or similar deep-merge utilities.
Validate and sanitize incoming JSON to reject reserved keys such as __proto__, constructor, and prototype.

Patch Information

The upstream maintainer fixed the issue in uPlot 1.6.31. The fix adds checks that prevent writes from resolving to Object.prototype during recursive assignment. Review the GitHub Commit History for the exact change set and verify the patched version is present in all production bundles, including transitive dependencies.

Workarounds

Wrap uplot.assign calls in a sanitization layer that strips prototype-resolving keys from input objects before merging.
Use Object.create(null) for configuration containers to remove the inherited prototype chain when feasible.
Apply server-side input filtering on dashboard configuration APIs to reject payloads containing __proto__ or constructor.prototype paths.

bash

# Configuration example
npm install uplot@^1.6.31
npm audit --production