GHSA-5pm8-492c-92p5
- Source
- https://github.com/advisories/GHSA-5pm8-492c-92p5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-5pm8-492c-92p5/GHSA-5pm8-492c-92p5.json
- Aliases
- Published
- 2019-12-02T18:04:11Z
- Modified
- 2024-02-19T05:31:30.845346Z
- Details
-
Affected versions of
@polymer/polymerare vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as{"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.Recommendation
Upgrade to version 3.2.0 or later.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-18841
- https://github.com/ankane/chartkick.js/issues/117
- https://github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885fa
- https://chartkick.com
- https://github.com/ankane/chartkick/blob/master/CHANGELOG.md
- https://github.com/ankane/chartkick/commits/master
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/chartkick/CVE-2019-18841.yml
- https://rubygems.org/gems/chartkick
Affected packages
RubyGems / chartkick
Package
- Name
- chartkick
Affected versions
0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
2.*
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.2.1
3.2.2
npm / chartkick
Package
- Name
- chartkick