How severe is GHSA-hfwx-c7q6-g54c?

No CVSS score has been assigned to GHSA-hfwx-c7q6-g54c yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-hfwx-c7q6-g54c?

GHSA-hfwx-c7q6-g54c affects the following packages: highcharts-export-server (npm). Ecosystems affected: npm.

How do I fix GHSA-hfwx-c7q6-g54c?

Update highcharts-export-server to 2.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hfwx-c7q6-g54c is resolved across your whole dependency graph.

How do I detect GHSA-hfwx-c7q6-g54c in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for highcharts-export-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-hfwx-c7q6-g54c if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-hfwx-c7q6-g54c actively exploited in the wild?

No public exploit code has been indexed for GHSA-hfwx-c7q6-g54c yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-hfwx-c7q6-g54c published, and has it been updated?

GHSA-hfwx-c7q6-g54c was published on March 12, 2021 and was last updated on March 12, 2021. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

Vulnerability allowing for reading internal HTTP resourcesGHSA-hfwx-c7q6-g54c

Fix: highcharts/node-export-server@53fa992

GHSA-hfwx-c7q6-g54c is a security vulnerability in highcharts-export-server. A fix is available for highcharts-export-server — see the affected versions and patch details below.

Published

Mar 12, 2021

Updated

Mar 12, 2021

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Mar 12, 2021 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

12other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

highcharts-export-servernpm

11Kdownloads / week

Description

Impact

The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources.

The impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses.

The previous versions have been marked as deprecated on NPM.

Patches

Version 2.1.0 released alongside this security advisory addresses the issue. Please note that this release is not backwards compatible out of the box. See the changelog for details.

Additionally, it's also recommended to upgrade to the latest version of Highcharts to get the added input sanitation implemented in version 9.0 and later.

Workarounds

There are no known workarounds to the issue - an upgrade to version 2.1.0 is required.

For more information

If you have any questions or comments about this advisory:

Open an issue in the export server issue tracker
Email us at [email protected]

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`highcharts-export-server`	all versions	2.1.0`npm install highcharts-export-server@2.1.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for highcharts-export-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update highcharts-export-server to 2.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hfwx-c7q6-g54c is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses. The previous versions have been marked as deprecated on NPM. ### Patches Version 2.1.0 released alongside this security advisory addresses the issue. **Please

O3 Security · Impact-Aware SCA

Is GHSA-hfwx-c7q6-g54c in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works