CVE-2020-16254

6.1 mediumEPSS 0.8%

Medium (6.1) in chartkick project chartkick. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in chartkick 3.4.0.

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

Severity

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2020-08-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-3j95-fjv2-3m4p	RubyGems	chartkick	<3.4.0	3.4.0