Prototype Pollution in chartkick

2019-12-0218:04:11

Google

osv.dev

0.002 Low

EPSS

Percentile

61.5%

JSON

Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as {"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.

Recommendation

Upgrade to version 3.2.0 or later.

CPENameOperatorVersion
chartkickeq1.4.0
chartkickeq2.3.2
chartkickeq2.2.0
chartkickeq2.1.2
chartkickeq1.2.5
chartkickeq1.2.2
chartkickeq3.0.0
chartkickeq3.2.0
chartkickeq1.5.2
chartkickeq0.0.4

Name	Operator	Version
chartkick	eq	1.4.0
chartkick	eq	2.3.2
chartkick	eq	2.2.0
chartkick	eq	2.1.2
chartkick	eq	1.2.5
chartkick	eq	1.2.2
chartkick	eq	3.0.0
chartkick	eq	3.2.0
chartkick	eq	1.5.2
chartkick	eq	0.0.4