Description
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | chartkick | < 3.4.0 | 3.4.0 | GHSA-3j95-fjv2-3m4p |
Medium · 6.1
CVE-2020-16254
EUVD-2020-0584GHSA-3j95-fjv2-3m4p
CSS Injection in Chartkick gem
Published Aug 5, 2020 · Updated Aug 4, 2024 · Assigned by mitre