Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2021-29489

Cross-Site Scripting (XSS) in highcharts (CVE-2021-29489)

Summary

Cross-site scripting in highcharts (CVE-2021-29489). Data can be tampered with by attackers. Exploitable via useHTML. Mitigation: upgrade to 9.0.0 or later.

Original description

The description as published by the source.

Impact

In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM. When useHTML was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.

If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.

Patches

In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.

Workarounds

Implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

References

For more information

If you have any questions or comments about this advisory:

  • Visit our [support page…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-29489 has been found in highcharts.
Attackers can target a specific entry point like useHTML over the network to misuse the product.
Data can be tampered with by attackers.
What to do: upgrade highcharts to 9.0.0 or later.
If unsure, ask your IT team or search "highcharts CVE-2021-29489" on the vendor's site.

CVE-2021-29489 (highcharts) — CWE-79
Attack vector: remote (network-reachable) / no user interaction
Attack surface: useHTML
Patched: 9.0.0 — apply immediately
Workaround: Implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Cross-site scripting (XSS) (CWE-79) exists in highcharts. Attackers reach the vulnerable code path via useHTML.

📍 Affected scope

Check the vendor advisory for the affected versions of highcharts. Attack surface: useHTML.

🔥 Severity

Severity: ?. Data can be tampered with by attackers.

🔧 How to fix

Update to 9.0.0.

🛡️ Workaround

Workaround: Implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'highcharts' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'highcharts' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で highcharts を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.

    パッチが適用されるまでの応急処置として、Implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade highcharts to 9.0.0

    ステージング環境で 9.0.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm highcharts
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details