chartkick 2.3.5

3 security vulnerabilities found in version 2.3.5

Prototype Pollution in chartkick

high severity CVE-2019-18841
high severity CVE-2019-18841
Affected versions: < 3.3.0

Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as {"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.

Recommendation

Upgrade to version 3.2.0 or later.

CSS injection with width and height options

medium severity CVE-2020-16254
medium severity CVE-2020-16254
Patched versions: >= 3.4.0

Chartkick is vulnerable to CSS injection if user input is passed to the width or height option.

<%= line_chart data, width: params[:width], height: params[:height] %>

An attacker can set additional CSS properties, like:

<%= line_chart data, width: "100%; background-image: url('http://example.com/image.png')" %>

XSS Vulnerability in Chartkick Ruby Gem

medium severity CVE-2019-12732
medium severity CVE-2019-12732
Patched versions: >= 3.2.0

Chartkick is vulnerable to a cross-site scripting (XSS) attack if both the following conditions are met:

Condition 1: It's used with ActiveSupport.escape_html_entities_in_json = false (this is not the default for Rails) OR used with a non-Rails framework like Sinatra.

Condition 2: Untrusted data or options are passed to a chart.

<%= line_chart params[:data], min: params[:min] %>

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.