GHSA-5793-x2q3-c3q7: XSS
Impact A credits.href value beginning with javascript: is assigned to the window location when the credits label is clicked, without being checked against an allowed-scheme list. An attacker who controls the chart configuration can therefore run script in the origin of the page hosting the chart. Exploitation requires that untrusted data reach the chart configuration and that a user click the credits label. Charts built with Highcharts Stock, Maps and Gantt are included, since those ship from the same package as Core.
Workarounds Drop-in fix - for any versions affected (5.0.0-13.0.2). Add the below IIFE to run after Highcharts is loaded, but before a chart is created.
js !function(t){if(t&&t.Chart&&!t.Chart.prototype.creditsHrefPatched){var r=t.Chart.prototype,e=r.addCredits;r.addCredits=function(n){var o=t.merge(!0,this.options.credits,n);return o&&o.href&&!c(o.href)&&delete o.href,e.call(this,o)},r.creditsHrefPatched=!0}function c(r){var e=t.AST&&t.AST.allowedReferences||["https://","http://","mailto:","/","../","./","#"];return"string"==typeof r&&e.some(function(t){return 0===r.indexOf(t)})}}(Highcharts); Live demo & testing
Obtaining the patched version The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example npm install highcharts@ 13.1.0. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example https://code.highcharts.com/13.1.0/highcharts.js. For more on each installation method, see the installation guide.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/highchartsto a version that resolves this vulnerability.Fixed in 13.1.0 - Upgrade
Upgrade
npm/highchartsto a version that resolves this vulnerability.Fixed in 12.6.1 - Upgrade
Upgrade
npm/highchartsto a version that resolves this vulnerability.Fixed in 11.4.9 - Upgrade
Upgrade
highchartsto a version that resolves this vulnerability.Fixed in 13.1.0 - Compensating control
If upgrading is not immediately possible, add the supplied IIFE after Highcharts is loaded and before creating a chart; it removes credits.href values that do not begin with an allowed scheme such as https://, http://, mailto:, /, ../, ./, or #.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Highcharts versions 5.0.0 through 13.0.2 are affected if untrusted data can control chart configuration, specifically the credits.href value. Highcharts Stock, Maps, and Gantt are also included because they ship from the same package as Core.
What must happen for exploitation to succeed?
An attacker must be able to supply a chart configuration containing a credits.href value beginning with javascript:. A user must then click the chart's credits label, causing script to execute in the origin hosting the chart.
What can be done if updating is not immediately possible?
Apply the provided drop-in IIFE after Highcharts loads and before any chart is created. The workaround removes credits.href values unless they begin with an allowed reference scheme or prefix, and is stated to apply to all affected versions.