CVE-2023-46308 is a critical severity (CVSS 9.8) prototype pollution flaw in plotly.js before 2.25.2. Plot API calls can pollute proto through expandObjectPaths or nestedProperty. Upgrade to 2.25.2 or later, and check apps and wrappers that bundle their own copy of the library.
What's affected
The record says plotly.js before 2.25.2 is affected. The release notes for v2.25.2 list a fix for potential prototype pollution in plot API calls, tracked in pull requests 6703 and 6704. The release page does not describe which calls are affected or how the fix works.
The record also links an issue in plotly.R, which is a reminder that wrappers and other language bindings can ship an older bundled copy of plotly.js. The weakness is CWE-1321.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-1321 (prototype pollution). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
For npm projects, find every copy:
npm ls plotly.js
npm ls plotly.js-dist plotly.js-dist-min plotly.js-basic-dist
For yarn use yarn why plotly.js. Check the lockfile for versions below 2.25.2. Also look at built bundles and wrapper packages, such as the R and Python bindings, which can embed their own copy.
What to do now
- Find every plotly.js copy in your applications, lockfiles and built assets.
- Upgrade to 2.25.2 or later and rebuild bundles.
- Update wrapper packages that embed plotly.js and check which version they ship.
- Avoid passing untrusted keys into plot API calls until you have updated.
- Rescan to confirm the finding closes. Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether the affected package is in your tree.
Why it matters
Prototype pollution lets input change the shared prototype of JavaScript objects, so every object in the page can inherit an attacker chosen property. The result depends on what the rest of the application does with those properties. It can alter logic, break pages, or in some applications lead to script execution.
The 9.8 score reflects the worst case in the vector. Real impact depends on how your app feeds data to the plot API. That is where reachability analysis helps: it shows whether your code actually calls the vulnerable path.
Try it yourself
A library flaw matters most when your code reaches it. This demo shows how reachability analysis separates reachable findings from the rest.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
plotly.js 2.25.2 and later.
Do I need to worry if I use a wrapper?
Yes. Wrappers can bundle an older plotly.js, so check the version they ship.
Sources
Last reviewed: 19 October 2026.
