Executive brief
Highcharts is a JavaScript charting library used to render interactive graphs and charts in web applications. Versions 8 and earlier do not filter the chart options structure for malicious code, allowing attackers to inject and execute JavaScript in end users' browsers if the application passes untrusted configuration data to the library. This can lead to credential theft, session hijacking, or malware distribution.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in Highcharts' options parsing and rendering layer. Affected versions (8 and earlier) directly insert HTML from the options structure into the DOM without sanitization, particularly when the useHTML flag is enabled. Even with useHTML disabled, attackers can bypass filtering using character replacement tricks or malformed HTML. The attack requires that untrusted configuration data be passed directly to Highcharts; charts configured from static or pre-filtered sources are unaffected. Version 9 fixes the issue by refactoring the rendering layer to use a DOMParser, AST, and HTML allowlisting. Workarounds include recursively applying DOMPurify to the options structure before passing it to Highcharts.
Affected products
- Highcharts Highcharts 8 and earlier
Timeline
- 2021-05-06: disclosed
- 2021-05-06: patched: Fixed in version 9.0.0