CVE-2024-21489 describes a prototype pollution vulnerability in the uplot JavaScript package affecting versions prior to 1.6.31. The vulnerability occurs because the uplot.assign function does not verify whether an attribute being assigned resolves to the object prototype, allowing attackers to manipulate the prototype chain. This flaw can be exploited remotely without authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability has a high CVSS 4.0 base score of 8.8, reflecting its potential impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform prototype pollution, potentially leading to application logic corruption or other integrity issues. The CVSS vector indicates high impact on integrity with low attack complexity and no required privileges or user interaction. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of uplot should monitor official sources for updates or patches addressing this vulnerability. Until a fix is available, avoid using vulnerable versions in untrusted environments or apply additional safeguards to limit exposure to untrusted input.