Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XSS Vulnerability in Chartkick Ruby Gem #488

Closed
ankane opened this issue Jun 4, 2019 · 0 comments

Comments

Projects
None yet
1 participant
@ankane
Copy link
Owner

commented Jun 4, 2019

Under certain conditions, the Chartkick Ruby gem is vulnerable to a cross-site scripting (XSS) attack. This vulnerability has been assigned the CVE identifier CVE-2019-12732.

Versions Affected: 3.1.0 and below
Fixed Versions: 3.2.0

Impact

Chartkick is vulnerable to a cross-site scripting (XSS) attack if BOTH the following conditions are met:

Condition 1: It's used with ActiveSupport.escape_html_entities_in_json = false (this is not the default for Rails) OR used with a non-Rails framework like Sinatra.

Condition 2: Untrusted data or options are passed to a chart.

<%= line_chart params[:data], min: params[:min] %>

Note that your database can also contain untrusted data.

<%= column_chart Visit.group(:user_agent).count %>

All users running an affected release should upgrade immediately.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.