Description
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user’s browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM.
Recommendation
Update the highcharts package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.0.0
- Patched version(s): 9.0.0
References
- GHSA-8j65-4pcq-xq95
- www.npmjs.com
- security.netapp.com
- CVE-2021-29489
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
- Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
- Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
- Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565
- Tags:
- npm
- highcharts
Anything's wrong? Let us know Last updated on January 29, 2023