AIKIDO-2025-10221

TL;DR

Affected versions of the chartist package are vulnerable to prototype pollution due to missing validation when assigning object properties. An attacker can exploit this by injecting malicious properties via the __proto__ key, which can recursively pollute the object prototype and affect all objects across the application.