HighGHSA-h68q-55jf-x68wCVE-2020-7746

Prototype pollution in chart.js

Published 10 May 2021 · Updated 14 Jan 2025

Affected package

chart.jsnpm
Affected
<2.9.4
Fixed in
2.9.4
Update to the fixed version for your release line, for example:npm install chart.js@2.9.4

Details

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

Is GHSA-h68q-55jf-x68w in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected chart.js, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.