CVE-2021-29489: Highcharts JS is a JavaScript charting library based on SVG

Description

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 59% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CB

Cloud Backup · Netapp

All versions, or not specified · source: NVD

HI

Highcharts · Highcharts

before 9.0.0 · source: NVD

OI

Oncommand Insight · Netapp

All versions, or not specified · source: NVD

OW

Oncommand Workflow Automation · Netapp

All versions, or not specified · source: NVD

SN

Snapcenter · Netapp

All versions, or not specified · source: NVD