Cross-Site Scripting Vulnerability in highcharts
Summary
GHSA-gr4j-r575-g665: Cross-Site Scripting in highcharts. Affects highcharts across 2 version ranges.
< 7.2.2
>= 8.0.0, < 8.1.1
Fixed in 7.2.2 or 8.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Highcharts is a popular JavaScript charting library used for visualizing data on web pages. It provides a wide range of interactive and customizable charts. However, versions of the highcharts package prior to 7.2.2 or 8.1.1 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability occurs due to the package's failure to properly sanitize href values and restrict URL schemes. As a result, an attacker can execute arbitrary JavaScript code in a victim's browser if they click on a malicious link.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in highcharts allows an attacker to inject and execute arbitrary JavaScript code in a victim's browser. By crafting a malicious link with a specially crafted href value, an attacker can trick a user into clicking on the link, leading to the execution of the injected code. This can result in various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim.
How To Fix
Latest published version: 13.1.1 as of 23 Oct 2026
npm install highcharts@13.1.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.2.27.2.2npm install highcharts@7.2.2 -
>= 8.0.0, < 8.1.18.1.1npm install highcharts@8.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the highcharts package is not immediately feasible, a temporary workaround is to manually sanitize and validate any user-generated href values before using them in the charts. This can be done by implementing a custom function that checks for malicious code and restricts the use of certain URL schemes. Here's an example of how to sanitize an href value in JavaScript:
function sanitizeHref(href) {
// Remove any JavaScript code
href = href.replace(/javascript:/gi, '');
// Restrict URL schemes
if (!/^https?:///i.test(href)) {
href = '';
}
return href;
}
By using this function to sanitize user-generated href values, you can mitigate the risk of XSS attacks until the package is updated.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in the highcharts package can have serious security implications for applications using vulnerable versions. It is crucial to update to version 7.2.2 or 8.1.1 or later to mitigate the risk of XSS attacks. If immediate updating is not possible, implementing a manual workaround to sanitize and validate user-generated href values can provide temporary protection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for highcharts →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the victim's browser, compromising their sensitive information or performing unauthorized actions.
If your application uses a vulnerable version of the highcharts package, it is susceptible to Cross-Site Scripting (XSS) attacks. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in your users' browsers, potentially leading to data theft, session hijacking, or other malicious activities.
No, only versions prior to 7.2.2 or 8.1.1 are vulnerable to this Cross-Site Scripting (XSS) issue. It is crucial to update to a fixed version to ensure the security of your application.
Yes, you can manually sanitize and validate user-generated href values before using them in the charts. Implementing a custom function to remove any potential malicious code and restrict certain URL schemes can help mitigate the risk of XSS attacks until the package is updated.
You can find more information about the highcharts vulnerability, including the affected versions and fixed versions, in the advisory published by the GitHub Security Advisory Database. Here is the link to the advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-gr4j-r575-g665/GHSA-gr4j-r575-g665.json
References
Related vulnerabilities
Recent vulnerabilities recorded for highcharts.
