| Package | Affected versions | Patched versions |
|---|---|---|
| chartkick | < 3.3.0 | 3.3.0 |
| chartkick.js | ≥ 3.1.0, ≤ 3.1.3 | |
| chartkick | ≥ 3.1.0, < 3.2.0 | 3.2.0 |
Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as {"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.
Upgrade to version 3.2.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free