Cross-Site Scripting

Overview Impact In highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the useHTML flag, HTML string options...

GHSA-8J65-4PCQ-XQ95 Options structure open to Cross-site Scripting if passed unfiltered

Impact In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the useHTML flag, HTML string options would be...

Options structure open to Cross-site Scripting if passed unfiltered

Impact In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the useHTML flag, HTML string options would be...

Cross-Site Scripting (XSS)

highcharts is vulnerable to cross-site scripting. The vulnerability exists because the chart options structure is not validated and sanitized when using useHTML flag, potentially allowing an attacker to inject and execute arbitrary Javascript in a user's browser...

CVE-2021-29489

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

CVE-2021-29489

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

CVE-2021-29489

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

Design/Logic Flaw

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

CVE-2021-29489 Options structure open to XSS if passed unfiltered

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

CVE-2021-29489

Highcharts JS (charting library) versions 8 and earlier are vulnerable to cross-site scripting due to inadequate filtering of the chart options structure for XSS vectors. The vulnerability can allow execution of untrusted script in the end user’s browser if the configuration contains malicious in...

CVE-2021-29489: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

Highcharts JS 跨站脚本漏洞

Highcharts JS is an SVG-based JavaScript charting framework. DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in Highcharts JS, which can be exploited by an attacker to execute code in a browser...

Information Disclosure

highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...

Exposure of internal HTTP resources

Overview In highcharts-export-server before version 2.1.0 there is a vulnerability that allows exposure of internal HTTP resources. Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export...

Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

GHSA-HFWX-C7Q6-G54C Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

Prototype Pollution

Amendment This was deemed not a vulnerability. Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. The function recursively merges the...

Cross-Site Scripting (XSS)

highcharts is vulnerable to cross-site scripting XSS. Lack of sanitization of href values and no URL schemes restriction allows an attacker to inject malicious javascript and get executed when a user visits the page...

@gooddata/react-components (>=7.1.0-alpha, <=7.9.2-beta.20), @gooddata/sdk-ui (8.0.0-alpha.14) +38 more potentially affected by unknown CVE via highcharts (>=7.0.0, <=7.2.1)

highcharts NPM version =7.0.0, =7.1.0-alpha, =8.0.0-alpha-afi-afi-one-4619-turn-off-lines-option-2020-09-03T22-09-02-779Z, =0.0.111, =1.1.34, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =7.3.0, =4.1.12, =6.0.0, =0.1.1, =0.1.2 - fe-chart-lib 1.0.0 and more Source cves: unknown CVE Source advisory:...

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...