Launchpad.net

CVE 2019-18841

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.

See the CVE page on Mitre.org for more details.