chartkick 3.1.0
Prototype Pollution in Chartkick.js 3.1.x
high severity CVE-2019-18841>= 3.3.0
< 3.1.0
A specially crafted response in data loaded via URL can cause prototype pollution in JavaScript.
CSS injection with width and height options
medium severity CVE-2020-16254>= 3.4.0
Chartkick is vulnerable to CSS injection if user input is passed to the width or height option.
<%= line_chart data, width: params[:width], height: params[:height] %>
An attacker can set additional CSS properties, like:
<%= line_chart data, width: "100%; background-image: url('http://example.com/image.png')" %>
XSS Vulnerability in Chartkick Ruby Gem
medium severity CVE-2019-12732>= 3.2.0
Chartkick is vulnerable to a cross-site scripting (XSS) attack if both the following conditions are met:
Condition 1:
It's used with ActiveSupport.escape_html_entities_in_json = false
(this is not the default for Rails)
OR used with a non-Rails framework like Sinatra.
Condition 2: Untrusted data or options are passed to a chart.
<%= line_chart params[:data], min: params[:min] %>
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.