GitHub Advisoryadvisory · npm

GHSA-gr4j-r575-g665 Cross-Site Scripting in highcharts

HIGH Published 2020-08-25 Modified 2023-11-10 Official page ↗
Ecosystem
npm
Packages
highcharts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-08-25

Affected packages

• npm highcharts: < 7.2.2 → fixed in 7.2.2 • npm highcharts: >= 8.0.0, < 8.1.1 → fixed in 8.1.1

Description

Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References