CVE-2020-16254: Chartkick Project Chartkick

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

Affected products

• Chartkick Project Chartkick: up to and including 3.3.2

Published 2020-08-05. Last modified 2026-06-17.