{"id":"GHSA-gr4j-r575-g665","aliases":[],"url":"https://o3.security/vulnerability/GHSA-gr4j-r575-g665","summary":"Cross-Site Scripting in highcharts","details":"Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.","published":"2020-08-25T14:04:47Z","modified":"2023-11-10T18:07:18Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"highcharts","fixedVersion":"7.2.2"},{"ecosystem":"npm","name":"highcharts","fixedVersion":"8.1.1"}],"fix":{"url":"https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5","label":"highcharts/highcharts@55c39dd"},"references":[{"type":"WEB","url":"https://github.com/highcharts/highcharts/issues/13559"},{"type":"WEB","url":"https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5"},{"type":"PACKAGE","url":"https://github.com/highcharts/highcharts"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-HIGHCHARTS-571995"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-10T18:07:18Z"}}