Risk of __proto__ pollution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Dec 23, 2025 · OSV.dev

   Detected

   The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

2. Dec 26, 2025 · OSV.dev

   Fix available

   plotly fixed in 4.12.0

3. Dec 26, 2025 · OSV.dev

   Fix available

   plotly fixed in 4.12.0

4. Dec 26, 2025 · OSV.dev

   Updated

   The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

Affected

• CRAN plotly2.0.2 → 4.12.0

Sources

• OSV.devPackage advisoryRSEC-2025-1

  Risk of __proto__ pollution Vulnerability

  osv.dev

References

• WEB · github.com
• WEB · github.com
• WEB · nvd.nist.gov