GHSA-gr4j-r575-g665 is a high-severity (CVSS 8.7) vulnerability in highcharts. A fix is available for highcharts — see the affected versions and patch details below.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
highchartsnpmDescription
Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | highcharts | all versions | 7.2.2npm install highcharts@7.2.2 |
| 📦npm | highcharts | ≥ 8.0.0&&< 8.1.1 | 8.1.1npm install highcharts@8.1.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for highcharts, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update highcharts to 7.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gr4j-r575-g665 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is GHSA-gr4j-r575-g665 in your dependencies?
Find it across npm, including transitive dependencies.