Executive brief
c3 is a popular JavaScript charting library used to visualize data in web applications. The library failed to properly sanitize HTML in chart tooltips, allowing an attacker to inject malicious scripts that execute in users' browsers and potentially steal sensitive data or session information without their knowledge.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw in c3's tooltip rendering mechanism. The root cause is improper HTML sanitization when displaying chart tooltips—user-supplied or attacker-controlled data in chart columns is rendered directly into the tooltip without escaping special characters. An attacker can craft chart data containing script tags or JavaScript event handlers that execute when a user hovers over chart elements. The attack requires network access to a page using the vulnerable c3 library and can be triggered by embedding malicious chart data. The vulnerability was fixed in version 0.4.11 by properly escaping HTML in tooltip output.
Affected products
- c3 c3 0.4.10 and earlier
Timeline
- 2016-01-14: disclosed: Security vulnerability reported in GitHub issue #1536
- 2016: patched: Fixed in version 0.4.11
- 2020-09-01: advisory: GHSA-gvg7-pp82-cff3 published