{"answers":{"affected":"2 open source packages ship an affected version, including highcharts-export-server.","exploited":"There is no known exploitation of GHSA-hfwx-c7q6-g54c in the wild and no public exploit code.","fix":"Upgrade highcharts-export-server to 2.1.0 or later.","what":"GHSA-hfwx-c7q6-g54c is a server-side request forgery vulnerability in highcharts-export-server, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-hfwx-c7q6-g54c and fix it if it is affected.\n\nWhat it is: GHSA-hfwx-c7q6-g54c is a server-side request forgery vulnerability in highcharts-export-server, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-hfwx-c7q6-g54c in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- highcharts-export-server (npm): affected all versions; fixed in 2.1.0\n- highcharts-export-server (npm): affected all versions; fixed in 2.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-hfwx-c7q6-g54c/ (Markdown: https://insights.sbomify.com/GHSA-hfwx-c7q6-g54c/index.md)","id":"GHSA-hfwx-c7q6-g54c","markdown":"https://insights.sbomify.com/GHSA-hfwx-c7q6-g54c/index.md","name":"GHSA-hfwx-c7q6-g54c","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Highcharts export server","requires_auth":"none","summary":"An attacker can read internal HTTP resources via the export server, potentially exposing sensitive internal web content.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nThe vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources.\n\nThe impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses.\n\nThe previous versions have been marked as deprecated on NPM.\n\n### Patches\n\nVersion 2.1.0 released alongside this security advisory addresses the issue. **Please note that this release is not backwards compatible out of the box. See the [changelog](https://github.com/highcharts/node-export-server/blob/master/CHANGELOG.md) for details.**\n\nAdditionally, it's also recommended to upgrade to the latest version of Highcharts to get the added input sanitation implemented in version 9.0 and later. \n\n### Workarounds\n\nThere are no known workarounds to the issue - an upgrade to version 2.1.0 is required.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the export server issue tracker](https://github.com/highcharts/node-export-server/issues)\n* Email us at [security@highsoft.com](mailto:security@highsoft.com)","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Vulnerability allowing for reading internal HTTP resources","id":"GHSA-hfwx-c7q6-g54c","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"ssrf","year":"2021"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2.1.0"],"introduced":["0"],"last_affected":[],"package":"highcharts-export-server","purl":null,"source":"GHSA-hfwx-c7q6-g54c"},{"ecosystem":"npm","fixed":["2.1.0"],"introduced":["0"],"last_affected":[],"package":"highcharts-export-server","purl":"pkg:npm/highcharts-export-server","source":"GHSA-hfwx-c7q6-g54c"}],"products":null,"published":"2021-03-12","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can read internal HTTP resources via the export server, potentially exposing sensitive internal web content.","url":"https://insights.sbomify.com/GHSA-hfwx-c7q6-g54c/"}