Executive brief
Chart.js is a popular JavaScript library used to render interactive charts and graphs in web applications. A prototype pollution vulnerability in the options parameter allows attackers to inject malicious properties into core JavaScript objects, potentially enabling denial-of-service attacks or code execution in affected web applications.
Technical details
Chart.js versions before 2.9.4 contain a prototype pollution vulnerability in the options parameter processing. When options are merged with default or existing options via a deep merge operation, the keys being set are not validated, allowing an attacker to pollute the Object prototype by injecting properties like `__proto__`. The vulnerability is reachable via the network if an application accepts untrusted options input (e.g., via URL parameters or JSON payloads). An attacker can trigger denial-of-service or potentially achieve code execution depending on how polluted properties are used downstream. The fix, merged in October 2020, uses Object.create(null) as the merge target to prevent prototype pollution.
Affected products
- Chart.js Chart.js before 2.9.4
Timeline
- 2020-10-29: disclosed
- 2020-10-18: patched: Fix merged in PR #7920
- 2021-05-10: advisory: GitHub advisory published