GHSA-gr4j-r575-g665

What it actually does

A cross-site scripting flaw in Highcharts allows attacker-controlled chart content (titles, series names, axis labels, tooltips, and similar text the library renders) to be treated as active HTML or script instead of plain text. When a victim views an affected chart, that content executes in the browser under the hosting application's origin, enabling session-token access, DOM tampering, and authenticated actions as the victim. CosmWasm wasmd consumers that embed or surface the same charting path inherit the same client-side script-injection exposure until upgraded.

Why it matters to the business

Compromise of user sessions and data shown in analytics or dashboard UIs, possible account takeover, and reputational harm if customer-facing charts are abused. Highcharts is a common npm dependency in enterprise web apps, so unpatched copies can persist across many products. The issue has been public since August 2020 (over six years), is not in CISA KEV, is not associated with ransomware, and has no recorded exploit maturity—residual risk is therefore concentrated in environments that still ship Highcharts below the fixed releases or wasmd below 0.52.0.

How an attack unfolds

An attacker finds an application that feeds user-influenced or otherwise untrusted strings into a vulnerable Highcharts instance (or a wasmd-based surface that uses that charting path). They submit crafted text intended for a chart label or similar rendered field. When an authenticated user later opens the chart, the library renders the text unsafely and the attacker's script runs in the application's origin. From there the attacker can steal session material, alter what the user sees, or issue requests as that user. No public exploit code or named threat actors are tied to this advisory.

How to fix it

Upgrade highcharts (npm) to 8.1.1 or later on the 8.x line, or to 7.2.2 or later on the 7.x line. Upgrade github.com/CosmWasm/wasmd to 0.52.0 or later. After upgrading, encode or sanitize all untrusted strings before they are passed into chart configuration, avoid treating chart labels as HTML unless strictly required, and deploy a tight Content-Security-Policy that disallows inline script as defense in depth. Rebuild and redeploy any bundles that vendor Highcharts so lockfiles and artifacts no longer pin vulnerable versions.

How to confirm the fix worked

Confirm installed versions with package-lock.json, yarn.lock, go.mod/go.sum, and SBOM/SCA scans: highcharts must be >= 8.1.1 or >= 7.2.2 as applicable, and wasmd must be >= 0.52.0. Search repositories and container images for older highcharts and wasmd pins. In a staging environment, submit benign but HTML-like text into chart titles and labels and verify it is shown as text only (no markup execution). Review CSP reports after rollout for residual inline-script violations on chart pages.

Typical attack path

1. Identify a web application that renders untrusted or user-influenced data with a vulnerable Highcharts (or wasmd) release.
2. Place malicious markup or script into a field that is later drawn as chart text (title, series, tooltip, or label).
3. Wait for or lure a victim to load the page that displays that chart while authenticated.
4. Script runs in the victim's browser with the application's origin privileges.
5. Abuse the session (token theft, in-app actions, or data access) and optionally persist further content in stored chart data.

How to detect it

This advisory has no known in-the-wild exploitation or named actors, so treat hunting as best-effort historical review rather than an assumed breach. Inspect web access, WAF, and reverse-proxy logs for chart-rendering or dashboard endpoints that received unusual markup in query strings, POST bodies, or saved chart definitions. Review CSP violation reports and browser-error telemetry around chart pages for unexpected script execution. In application databases or object stores, look for stored chart configurations whose titles, series names, or tooltips contain HTML or event-handler attributes. On hosts, confirm whether production bundles still include Highcharts before 8.1.1/7.2.2 or wasmd before 0.52.0—that indicates exposure, not necessarily prior compromise. Log retention from 2020 may be gone; focus on current production artifacts and any period still retained.

What your security team should do

• Inventory every service that depends on highcharts (npm) or github.com/CosmWasm/wasmd and flag versions below 8.1.1 / 7.2.2 and 0.52.0 respectively.
• Patch and redeploy those components first on internet-facing dashboards that chart user-supplied or multi-tenant data.
• Enforce SCA/policy gates so vulnerable Highcharts and wasmd versions cannot be merged or shipped.
• Ensure user-controlled chart fields are encoded server-side and that CSP blocks inline script on charting pages.
• Hunt historically for XSS-style activity against chart endpoints, then close the ticket only after version and encoding checks pass.