CVE-2019-18841

HIGH

Chartkick.js <3.1.4 - Info Disclosure

Title source: llm

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.

Core 6

Core References

Product, Release Notes x_refsource_misc

Patch x_refsource_misc

Product x_refsource_misc

Product, Release Notes x_refsource_misc

Patch x_refsource_confirm

Third Party Advisory x_refsource_misc

CVSS v3 7.3

EPSS 0.0062

EPSS Percentile 70.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Status published

Products (3)

chartkick/chartkick.js 3.1.0 - 3.1.3

npm/chartkick 3.1.0 - 3.2.0npm

rubygems/chartkick 0 - 3.3.0RubyGems

Published Nov 11, 2019

Tracked Since Feb 18, 2026