Description
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user’s browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM.
Recommendation
Update the highcharts package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.0.0
- Patched version(s): 9.0.0
References
- GHSA-8j65-4pcq-xq95
- www.npmjs.com
- security.netapp.com
- CVE-2021-29489
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Cross-site Scripting in epubjs - CVE-2021-33040
- Margox Braft-Editor Cross-site Scripting Vulnerability - CVE-2021-27524
- Cross-site Scripting in Froala Editor - froala-editor - CVE-2021-30109
- Cross-site Scripting in video.js - CVE-2021-23414
You might also like:
- Tags:
- npm
- highcharts
Anything's wrong? Let us know Last updated on January 29, 2023