CVE-2020-7746: Improper Input Validation

October 29, 2020 (updated July 21, 2021)

The options parameter in chart.js is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to prototype pollution.

References

nvd.nist.gov/vuln/detail/CVE-2020-7746

Code Behaviors & Features

Detect and mitigate CVE-2020-7746 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →