CVE-2020-7746: Prototype pollution in chart.js
Summary
CVE-2020-7746: Prototype pollution in chart.js. Affects chart.js versions < 2.9.4. Fixed in 2.9.4. How to fix ↓
Also tracked for
- node-chart.js · Debian:11
The same CVE-2020-7746 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chart.js is an open-source JavaScript library that allows developers to create interactive and responsive charts for web applications. It provides a wide range of chart types and customization options, making it a popular choice for data visualization. However, versions of chart.js prior to 2.9.4 are vulnerable to prototype pollution.
Vulnerability Detail
Prototype pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. In the case of chart.js, the options parameter is not properly sanitized during processing. When merging the provided options with the existing or default options, the keys of the object being set are not checked, leading to a potential prototype pollution. An attacker could exploit this vulnerability to modify the behavior of the application, potentially leading to unauthorized access, data manipulation, or denial of service.
How To Fix
Latest published version: 4.6.1 as of 23 Oct 2026
npm install chart.js@4.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.4
This is the first release that contains the fix.
npm install chart.js@2.9.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of chart.js as soon as possible.
Conclusion
The vulnerability in chart.js (CVE-2020-7746) is a critical issue that could allow an attacker to manipulate the behavior of the application through prototype pollution. It is crucial for developers to update their chart.js package to version 2.9.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for chart.js →
FAQ
Prototype pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. This can lead to unexpected behavior and potential security issues.
The consequences of this vulnerability can vary depending on how the chart.js library is used in the application. However, possible ramifications include unauthorized access, data manipulation, or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available in version 2.9.4 of chart.js. It is recommended to update your package to this version or later to mitigate the vulnerability.
There are no known workarounds for this vulnerability. Updating to the fixed version of chart.js is the recommended solution.
