CVE-2020-16254.yml

---
gem: chartkick
cve: 2020-16254
ghsa: 3j95-fjv2-3m4p
url: https://github.com/ankane/chartkick/issues/546
title: CSS injection with width and height options
date: 2020-08-04
description: |
  Chartkick is vulnerable to CSS injection
  if user input is passed to the width or height option.

  <%= line_chart data, width: params[:width], height: params[:height] %>

  An attacker can set additional CSS properties, like:

  <%= line_chart data, width: "100%; background-image: url('http://example.com/image.png')" %>
cvss_v3: 6.1
patched_versions:
  - ">= 3.4.0"