GHSA-hfwx-c7q6-g54c: 
JavaScript vulnerability analysis and mitigation

A high severity vulnerability was discovered in the highcharts-export-server npm package (versions <= 2.0.30), identified as GHSA-hfwx-c7q6-g54c. The vulnerability was published on March 12, 2021, and affects the node-export-server component of Highcharts. This security issue allows unauthorized access to internal HTTP resources when the export server is exposed to the internet (GitHub Advisory).

The vulnerability enables unauthorized reading and outputting of files served by other services on the internal network where the export server is hosted. The attack surface is limited to internal services that serve content via HTTP(S), and requires the attacker to have knowledge of internal hostnames or IP addresses. The affected versions (2.0.30 and earlier) have been marked as deprecated on NPM (GitHub Advisory).

If the export server is exposed to the internet, malicious users could potentially gain read access to internal web resources. This could lead to unauthorized access to sensitive information hosted on internal services, though the impact is specifically limited to content served through HTTP(S) protocols (GitHub Advisory).

The vulnerability requires the attacker to have knowledge of internal hostnames or IP addresses to successfully exploit the system. The export server must also be exposed to the internet for the vulnerability to be exploitable (GitHub Advisory).

The vulnerability has been patched in version 2.1.0. Users are strongly advised to upgrade to this version, as there are no known workarounds for the issue. Additionally, it is recommended to upgrade to Highcharts version 9.0 or later to benefit from added input sanitation. Note that version 2.1.0 is not backwards compatible out of the box (GitHub Advisory, Changelog).