CVE-2021-29489

Options structure open to Cross-site Scripting if passed unfiltered

Workarounds

Implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

References

• Details on the improved Highcharts security
• The AST and TextBuilder refactoring
• The fix for prototype pollution

For more information

If you have any questions or comments about this advisory:

• Visit our support page
• For more Email us at [email protected]

In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the useHTML flag, HTML string options would be inserted unfiltered directly into the DOM. When useHTML was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.

If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2021-29489 has a CVSS score of 7.6 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (9.0.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.

1. What is CVE-2021-29489? CVE-2021-29489 is a high-severity cross-site scripting (XSS) vulnerability in highcharts (npm), affecting versions < 9.0.0. It is fixed in 9.0.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2021-29489? CVE-2021-29489 has a CVSS score of 7.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of highcharts are affected by CVE-2021-29489? highcharts (npm) versions < 9.0.0 is affected.
4. Is there a fix for CVE-2021-29489? Yes. CVE-2021-29489 is fixed in 9.0.0. Upgrade to this version or later.
5. Is CVE-2021-29489 exploitable, and should I be worried? Whether CVE-2021-29489 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2021-29489 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2021-29489? Upgrade highcharts to 9.0.0 or later.

Other vulnerabilities in highcharts