GHSA-gr4j-r575-g665: 
JavaScript vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Highcharts, a JavaScript charting library, affecting versions prior to 7.2.2 and versions 8.0.0 to 8.1.1. The vulnerability was disclosed on June 11, 2020, and identified as GHSA-gr4j-r575-g665. The issue stems from the package's failure to properly sanitize href values and restrict URL schemes, which could allow attackers to execute arbitrary JavaScript in a victim's browser (GitHub Advisory).

The vulnerability occurs when the tag for text formats is translated into a tspan with onclick functionality, enabling script injection. The package failed to implement proper sanitization of href values, allowing potentially malicious JavaScript code to be executed. The vulnerability has been assigned a CVSS v3.1 score of 8.7 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The issue is classified as CWE-79, indicating a Cross-Site Scripting weakness (Snyk Report).

The vulnerability could lead to a total loss of confidentiality and integrity within the impacted component. If exploited, attackers could potentially steal cookies, hijack user sessions, expose sensitive information, gain access to privileged services and functionality, or deliver malware. The vulnerability is particularly concerning in scenarios where user-supplied input is used in chart configurations or when poorly sanitized input data is stored in the backend and later used in charts (GitHub Issue).

The vulnerability requires network access and user interaction for successful exploitation. An attacker needs low privileges to execute the attack, and the attack complexity is considered low. Snyk has confirmed the existence of a proof-of-concept exploit for this vulnerability (Snyk Report).

The vulnerability has been patched in versions 7.2.2 and 8.1.1. Users are strongly advised to upgrade to these or later versions. The fix involves implementing proper sanitization of href values and restricting JavaScript URL schemes in the SVGRenderer component (GitHub Commit).