CVE-2020-7746
Prototype pollution in chart.js
7.5
HIGH
CVSS 3.1
EPSS 0.21%
Description
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
How to fix CVE-2020-7746
To remediate CVE-2020-7746, upgrade the affected package to a fixed version below.
- —upgrade to 2.9.4+dfsg+~cs2.10.1-1 or later
- —upgrade to 2.9.4 or later
Is CVE-2020-7746 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.9.4+dfsg+~cs2.10.1-1
- from 0, < 2.9.4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |