GitHub Advisoryadvisory · npm

GHSA-h68q-55jf-x68w Prototype pollution in chart.js

HIGH Published 2021-05-10 Modified 2021-04-20 Official page ↗
Aliases
CVE-2020-7746
Ecosystem
npm
Packages
chart.js
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-04-20

Affected packages

• npm chart.js: < 2.9.4 → fixed in 2.9.4

Description

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

Related

Alias · CVE (1)

  • CVE-2020-7746 This affects the package chart.js before 2.9.4. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References