Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as {"__proto__": {"polluted": true}}. It is possible to achieve the same results if a chart loads data from a malicious server.

Recommendation

Upgrade to version 3.2.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-18841
• ankane/chartkick.js#117
• ankane/chartkick@b810936
• https://chartkick.com
• https://github.com/ankane/chartkick/blob/master/CHANGELOG.md
• https://github.com/ankane/chartkick/commits/master
• https://rubygems.org/gems/chartkick/
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/chartkick/CVE-2019-18841.yml