GHSA-gr4j-r575-g665 Cross-Site Scripting in highcharts
Attackers can execute arbitrary JavaScript in victims' browsers via unsanitized href values in Highcharts links, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-gr4j-r575-g665?
GHSA-gr4j-r575-g665 is a cross-site scripting vulnerability in highcharts, published on 25 Aug 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.Which versions are affected by GHSA-gr4j-r575-g665?
4 open source packages ship an affected version, including highcharts.
| Package | Affected | Fixed in |
|---|---|---|
highcharts npm | All versions | 7.2.2 |
highcharts npm | All versions | 7.2.2 |
highcharts npm | From 8.0.0 | 8.1.1 |
highcharts npm | From 8.0.0 | 8.1.1 |
How do I fix GHSA-gr4j-r575-g665?
Upgrade highcharts to a fixed version for your release line: 7.2.2 or 8.1.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-gr4j-r575-g665 being exploited?
There is no known exploitation of GHSA-gr4j-r575-g665 in the wild and no public exploit code.