← All advisories

High severity7.3NVD Advisory· Published Nov 11, 2019· Updated Jun 17, 2026

CVE-2019-18841

CVE-2019-18841

Description

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
chartkickRubyGems	< 3.3.0	3.3.0
chartkicknpm	>= 3.1.0, < 3.2.0	3.2.0

Affected products

3

Chartkick/Chartkick.js
cpe:2.3:a:chartkick:chartkick.js:*:*:*:*:*:*:*:*
Range: >=3.1.0,<=3.1.3
ghsa-coords2 versions
pkg:gem/chartkick pkg:npm/chartkick
< 3.3.0+ 1 more
- (no CPE)range: < 3.3.0
- (no CPE)range: >= 3.1.0, < 3.2.0

Patches

Vulnerability mechanics

References

10

github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885fanvdPatchWEB
github.com/ankane/chartkick/commits/masternvdPatchWEB
github.com/advisories/GHSA-5pm8-492c-92p5ghsaADVISORY
github.com/ankane/chartkick.js/issues/117nvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-18841ghsaADVISORY
chartkick.comnvdProductWEB
github.com/ankane/chartkick/blob/master/CHANGELOG.mdnvdProductRelease NotesWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/chartkick/CVE-2019-18841.ymlghsaWEB
rubygems.org/gems/chartkickghsaWEB
rubygems.org/gems/chartkick/nvdProductRelease Notes

News mentions

0

No linked articles in our index yet.