Options structure open to XSS if passed unfiltered
Priority LOW 35CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
Why it matters now
EPSS 0.00867 58th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 9.0.0highcharts (npm): 9.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| highcharts | highcharts | before 9.0.0 | 9.0.0 | Patch available | CNA |
| — | highcharts (npm) | before 9.0.0 | 9.0.0 | Patch available | GHSA-8j65-4pcq-xq95 |
- highcharts Vendorhighcharts Affected before 9.0.0 Fixed in 9.0.0 Patch available CNA
- highcharts (npm) Vendor— Affected before 9.0.0 Fixed in 9.0.0 Patch available GHSA-8j65-4pcq-xq95
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:highcharts:highcharts:*:*:*:*:*:*:*:* | before 9.0.0 | Vulnerable | highcharts |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:highcharts:highcharts:*:*:*:*:*:*:*:* Versions before 9.0.0 Vulnerable ·highcharts
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA highcharts (highcharts) Fixed in 9.0.0
- Fix · GHSA-8j65-4pcq-xq95 highcharts (npm) Fixed in 9.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29489
- 2026-10-03 Alias added: GHSA-8j65-4pcq-xq95
References
Advisory 3
More Highcharts vulnerabilities
- TI-2018-14772 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular… CVSS 3.0HIGH 7.5
Sources
- CVE-2021-29489 · CVE Program
- CVE-2021-29489 · NVD
- FIRST EPSS
- GHSA-8j65-4pcq-xq95 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences