CVE-2019-18841

7.3 highEPSS 1.4%

High (7.3) in chartkick chartkick.js. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in chartkick 3.2.0, 3.3.0.

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.

Severity

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
Published: 2019-11-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-5pm8-492c-92p5	RubyGems	chartkick	<3.3.0	3.3.0
GHSA-5pm8-492c-92p5	npm	chartkick	>=3.1.0 <3.2.0	3.2.0