Options structure open to Cross-site Scripting if passed unfiltered

Description

In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user’s browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM.

Recommendation

Update the highcharts package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.0.0
• Patched version(s): 9.0.0

References

• GHSA-8j65-4pcq-xq95
• www.npmjs.com
• security.netapp.com
• CVE-2021-29489
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in video.js - CVE-2021-23414
• Cross-site Scripting in curly-bracket-parser - CVE-2021-23416
• Cross-site Scripting in file-upload-with-preview - CVE-2021-23439
• Cross-site Scripting in Mermaid - CVE-2021-35513

Tags:

npm

highcharts