chartkick 3.2.1

2 security vulnerabilities found in version 3.2.1

Prototype Pollution in Chartkick.js 3.1.x

high severity CVE-2019-18841
high severity CVE-2019-18841
Patched versions: >= 3.3.0
Unaffected versions: < 3.1.0

A specially crafted response in data loaded via URL can cause prototype pollution in JavaScript.

CSS injection with width and height options

medium severity CVE-2020-16254
medium severity CVE-2020-16254
Patched versions: >= 3.4.0

Chartkick is vulnerable to CSS injection if user input is passed to the width or height option.

<%= line_chart data, width: params[:width], height: params[:height] %>

An attacker can set additional CSS properties, like:

<%= line_chart data, width: "100%; background-image: url('http://example.com/image.png')" %>

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.