CVE-2021-29489: Options structure open to XSS if passed unfiltered
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29489?
CVE-2021-29489 is classified as a high severity vulnerability.
How do I fix CVE-2021-29489?
To fix CVE-2021-29489, upgrade Highcharts to version 9.0.0 or later.
What systems are affected by CVE-2021-29489?
CVE-2021-29489 affects Highcharts versions 8 and earlier, as well as certain NetApp products using vulnerable Highcharts versions.
What type of vulnerability is CVE-2021-29489?
CVE-2021-29489 is an XSS (Cross-Site Scripting) vulnerability.
Can CVE-2021-29489 allow an attacker to execute code?
Yes, CVE-2021-29489 can allow code execution in the end user's browser from untrusted sources.