CVE-2019-18841: Prototype Pollution

November 11, 2019 (updated August 24, 2020)

Chartkick.js, as used in the Chartkick gem for Ruby, allows prototype pollution.

References

chartkick.com/
github.com/ankane/chartkick.js/issues/117
github.com/ankane/chartkick/blob/master/CHANGELOG.md
github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885fa
github.com/ankane/chartkick/commits/master
nvd.nist.gov/vuln/detail/CVE-2019-18841
rubygems.org/gems/chartkick/

Code Behaviors & Features

Detect and mitigate CVE-2019-18841 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →