CVE-2021-29489: Options structure open to XSS if passed unfiltered
First published: Wed May 05 2021(Updated: )
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Highcharts | <9.0.0 | |
| NetApp Cloud Backup | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Workflow Automation | ||
| NetApp SnapCenter |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-29489?
CVE-2021-29489 is classified as a high severity vulnerability.
How do I fix CVE-2021-29489?
To fix CVE-2021-29489, upgrade Highcharts to version 9.0.0 or later.
What systems are affected by CVE-2021-29489?
CVE-2021-29489 affects Highcharts versions 8 and earlier, as well as certain NetApp products using vulnerable Highcharts versions.
What type of vulnerability is CVE-2021-29489?
CVE-2021-29489 is an XSS (Cross-Site Scripting) vulnerability.
Can CVE-2021-29489 allow an attacker to execute code?
Yes, CVE-2021-29489 can allow code execution in the end user's browser from untrusted sources.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/title
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/highcharts
- canonical/highcharts
- vendor/netapp
- canonical/netapp cloud backup
- canonical/netapp oncommand insight
- canonical/netapp oncommand workflow automation
- canonical/netapp snapcenter