Prototype Pollution Vulnerability in Chart.js Package
Summary
CVE-2020-7746: This affects the package chart.js before 2.9.4. Affects node-chart.js across 2 version ranges.
< 2.9.4+dfsg+~cs2.10.1-1
< 9bd4cf82fda9f50a5fb50b72843e06ab88124278
Fixed in 2.9.4+dfsg+~cs2.10.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chart.js is a popular open-source JavaScript library used for creating interactive charts and visualizations in web applications. It provides a simple API for developers to create various types of charts, including line, bar, and pie charts. The library is widely adopted due to its ease of use and flexibility. However, prior to version 2.9.4, Chart.js had a vulnerability that allowed for prototype pollution, which could lead to significant security risks in applications utilizing the library.
Vulnerability Detail
The vulnerability identified as CVE-2020-7746 affects Chart.js versions before 2.9.4. It arises from improper sanitization of the options parameter during the processing of chart options. When user-defined options are merged with existing or default options, the keys of the object being set are not adequately checked. This oversight allows an attacker to manipulate the prototype of JavaScript objects, potentially leading to unauthorized access or modification of application data. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level.
How To Fix
Minimum fixed version
2.9.4+dfsg+~cs2.10.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-chart.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to sanitize the options parameter before passing it to Chart.js. This can be done by implementing a function that checks for and removes any potentially harmful keys from the options object. Here is an example of such a function:
function sanitizeOptions(options) {
const safeOptions = {};
for (const key in options) {
if (options.hasOwnProperty(key) && !key.startsWith('__')) {
safeOptions[key] = options[key];
}
}
return safeOptions;
}
// Usage
const safeChartOptions = sanitizeOptions(userProvidedOptions);
new
Chart(ctx, safeChartOptions);
Conclusion
The CVE-2020-7746 vulnerability in Chart.js poses a significant risk due to its potential for prototype pollution. It is crucial for developers using this library to upgrade to version 2.9.4 or later to ensure the security of their applications. Implementing the provided workaround can offer temporary relief, but a permanent fix through upgrading is recommended.
See every vulnerability recorded for node-chart.js →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of a JavaScript object, potentially leading to unauthorized access or modification of data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
Failing to address this vulnerability can expose your application to attacks that may compromise sensitive data, lead to unauthorized actions, or disrupt application functionality.
You should upgrade to Chart.js version 2.9.4 or later to mitigate the vulnerability.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-chart.js.
