{"cve":"CVE-2021-29489","nvd":{"published":"2021-05-05T16:15:08.023","modified":"2026-06-17T03:47:44.890","status":"Modified","description":"Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95","https://security.netapp.com/advisory/ntap-20210622-0005/","https://github.com/highcharts/highcharts/security/advisories/GHSA-8j65-4pcq-xq95","https://security.netapp.com/advisory/ntap-20210622-0005/"],"products":["highcharts:highcharts","netapp:cloud_backup","netapp:oncommand_insight","netapp:oncommand_workflow_automation","netapp:snapcenter"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-29489","score":0.00867,"percentile":0.58746,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-8j65-4pcq-xq95","url":"https://osv.dev/vulnerability/GHSA-8j65-4pcq-xq95","summary":"Options structure open to Cross-site Scripting if passed unfiltered","modified":"2026-07-08T06:29:26.405617494Z","packages":[{"ecosystem":"npm","name":"highcharts","purl":"pkg:npm/highcharts","ranges":["<9.0.0"],"fixed":["9.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}