GHSA-5pm8-492c-92p5

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-5pm8-492c-92p5/GHSA-5pm8-492c-92p5.json
Aliases
  • CVE-2019-18841
Published
2019-12-02T18:04:11Z
Modified
2022-11-22T01:02:52.418267Z
Details

Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as {"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.

Recommendation

Upgrade to version 3.2.0 or later.

References

Affected packages

RubyGems / chartkick

chartkick

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
3.3.0

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5

1.*

1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2

2.*

2.0.0
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5

3.*

3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.2.1
3.2.2

npm / chartkick

chartkick

Affected ranges

Type
SEMVER
Events
Introduced
3.1.0
Fixed
3.2.0

Affected versions

Database specific

{
    "last_known_affected_version_range": "<= 3.1.3"
}