CVE-2021-29489 Details
Description
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
A cross-site scripting (XSS) vulnerability exists in Highcharts JS versions prior to 9.0.0, which is incorporated in multiple NetApp products. In these vulnerable versions, the chart options structure was not properly sanitized, allowing content from untrusted sources to execute code in the end user's browser. This issue was particularly problematic when the 'useHTML' flag was enabled, as unfiltered HTML string options could be directly inserted into the DOM. Even with 'useHTML' disabled, malicious code could be injected using character replacement tricks or malformed HTML. The vulnerability could lead to the execution of arbitrary code in the user's browser.
Users unable to upgrade to Highcharts version 9.0.0 or later can apply DOMPurify recursively to the options structure to remove harmful markup.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95 | CVE | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210622-0005/ | CVE | Third Party Advisory |
| https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95 | [email protected] | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20210622-0005/ | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| highcharts highcharts | < 9.0.0 |
CPE
Remediation
| |
| netapp cloud backup | All versions |
CPE
Remediation
| |
| netapp oncommand insight | All versions |
CPE
Remediation
| |
| netapp oncommand workflow automation | All versions |
CPE
Remediation
| |
| netapp snapcenter | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jun 4, 2022 | Modified Analysis | [email protected] |
| Jun 22, 2021 | CVE Modified | [email protected] |
| May 14, 2021 | Initial Analysis | [email protected] |