UpHeron
All vulnerabilities

npm

GHSA-r27j-894h-3w3p

mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`

Severity
Low 3.7
Published
6 May 2026
Last changed
6 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.9.2
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
icu-minifynpm · osv:npm:icu-minify
  • Every version before 4.9.2

References