Executive brief
Highcharts is a popular JavaScript charting library used to create interactive data visualizations on websites. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into charts if unsanitized user input (such as chart titles, labels, or links) is used in chart configuration. An attacker could craft a malicious link that, when clicked by a user viewing a chart, executes arbitrary JavaScript in their browser, potentially stealing session data, account credentials, or other sensitive information.
Technical details
The vulnerability is a stored/reflected XSS (CWE-79) in Highcharts' handling of `<a>` tags within chart configuration. The library fails to properly sanitize href attributes and does not restrict URL schemes, converting `<a>` tags to `<tspan>` elements with onclick handlers. An attacker can inject arbitrary JavaScript URLs (using javascript: scheme or event handlers) through chart configuration properties such as titles, subtitles, labels, or tooltips. The vulnerability affects versions prior to 7.2.2 and 8.0.0–8.1.0. The root cause is insufficient input validation on URLs and attributes during DOM rendering. The vulnerability has been fixed in versions 7.2.2 and 8.1.1 via commit 55c39dd, which properly sanitizes URL schemes and href values.
Affected products
- Highcharts Highcharts before 7.2.2, 8.0.0 to before 8.1.1
Timeline
- 2020-05-20: disclosed: Vulnerability reported on GitHub issue #13559
- 2020-05-20: patched: Fix committed (55c39dd) same day
- 2020-08-25: advisory: GHSA-gr4j-r575-g665 published