Prototype Pollution

Vulnerability

Overview

CVE-2020-7746 is a prototype pollution vulnerability in the Chart.js library, affecting versions before 2.9.4. The root cause lies in the options parameter processing: when user-supplied options are deeply merged with existing or default options, the merge function does not validate object keys. This allows an attacker to inject properties like __proto__ or constructor.prototype into the merge target, leading to pollution of the global Object.prototype [1][2].

Exploitation

Exploitation requires the attacker to control the options object passed to a Chart.js chart instance. No authentication is needed if the application accepts user input for chart configuration (e.g., via a web form or API). The merge operation recursively copies properties without checking for special keys, so a crafted payload containing "__proto__": {"polluted": true} can set arbitrary properties on all JavaScript objects in the runtime [4].

Impact

Successful prototype pollution can lead to denial of service (e.g., by causing exceptions) or, in more severe cases, remote code execution if the polluted property influences application logic. For example, an attacker could override default settings or inject malicious code paths that are later executed [4].

Mitigation

The vulnerability was fixed in Chart.js version 2.9.4 by using Object.create(null) as the merge target, which prevents prototype pollution by ensuring the target object has no prototype chain [2]. Users should upgrade to 2.9.4 or later. No workarounds are documented; patching is the recommended action.