CVE-2021-29489: Options structure open to XSS if passed unfiltered
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts JSto a version that resolves this vulnerability.Fixed in 9 - Compensating control
For implementations unable to upgrade, apply DOMPurify recursively to the chart options structure to filter malicious markup.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29489?
CVE-2021-29489 is classified as a high severity vulnerability.
How do I fix CVE-2021-29489?
To fix CVE-2021-29489, upgrade Highcharts to version 9.0.0 or later.
What systems are affected by CVE-2021-29489?
CVE-2021-29489 affects Highcharts versions 8 and earlier, as well as certain NetApp products using vulnerable Highcharts versions.
What type of vulnerability is CVE-2021-29489?
CVE-2021-29489 is an XSS (Cross-Site Scripting) vulnerability.
Can CVE-2021-29489 allow an attacker to execute code?
Yes, CVE-2021-29489 can allow code execution in the end user's browser from untrusted sources.