Description
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user’s browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM.
Recommendation
Update the highcharts package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.0.0
- Patched version(s): 9.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Options structure open to Cross-site Scripting if passed unfiltered and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cross-site Scripting in epubjs - CVE-2021-33040
- Margox Braft-Editor Cross-site Scripting Vulnerability - CVE-2021-27524
- Cross-site Scripting in Froala Editor - froala-editor - CVE-2021-30109
- Cross-site Scripting in video.js - CVE-2021-23414
You might also like:
See something that needs correcting? Let us knowUpdated January 29, 2023