CVE-2019-18841

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://chartkick.comProduct
https://github.com/ankane/chartkick.js/issues/117Third Party Advisory
https://github.com/ankane/chartkick/blob/master/CHANGELOG.mdProduct, Release Notes
https://github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885faPatch
https://github.com/ankane/chartkick/commits/masterPatch
https://rubygems.org/gems/chartkick/Product, Release Notes
https://chartkick.comProduct
https://github.com/ankane/chartkick.js/issues/117Third Party Advisory
https://github.com/ankane/chartkick/blob/master/CHANGELOG.mdProduct, Release Notes
https://github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885faPatch
https://github.com/ankane/chartkick/commits/masterPatch
https://rubygems.org/gems/chartkick/Product, Release Notes

Timeline

Published: Nov 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-188426.1A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Modul CVE-2019-188447.5The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci_core.h (in CVE-2019-188457.1The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and writ CVE-2019-188465.0OX App Suite through 7.10.2 allows SSRF.CVE-2019-188479.8Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.CVE-2019-188487.5The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.CVE-2019-188495.5In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winma CVE-2019-18857.2A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inj CVE-2019-188507.5TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP me CVE-2019-188529.8Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config CVE-2019-188536.5ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/CVE-2019-188547.5A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion f