CVE-2020-16254 – The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (C

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16254

Reference (s):

• https://github.com/ankane/chartkick
• https://github.com/ankane/chartkick/issues/546