New Highcharts security advisories: What you need to know

We have published 16 new security advisories affecting Highcharts Core, Dashboards, Grid Lite and Grid Pro.

The vulnerabilities were identified through ongoing security testing and involve several ways that untrusted or user-controlled input can, under specific conditions, bypass protections in our products.

We have released fixes for the identified vulnerabilities. 

Full technical details, including affected versions, patched versions, severity ratings and workarounds where available, can be found in our GitHub Security Advisories.

What Highcharts users should do

We recommend that customers review the advisories relevant to the Highcharts products they use and upgrade to the patched versions. We’ve released fixes across multiple major versions, so you don’t have to jump to the latest major to get them.

Upgrade to your patched version of choice using npm:

If you load from the CDN, use the versioned URLs on code.highcharts.com.

As an additional layer of protection, applications should sanitize untrusted content before passing it to Highcharts, particularly where users or external data sources can influence chart, dashboard or grid configuration or content.

Does this affect my implementation?

If untrusted or user-controlled data can reach your Highcharts configuration, you should upgrade to a patched version. This may apply to your implementation if, for example:

• End users can create, save or share chart, dashboard or grid configurations in your application.
• Titles, labels, column definitions or language strings come from user-editable settings, translation systems or a CMS.
• Your application renders configuration stored by one user or tenant to other users.
• Data is loaded from user-supplied sources, and object keys or column names from that data are used in the configuration.
• Editors or customers can enter configuration through a plugin, embed or integration.

If you are unable to upgrade immediately, review the relevant security advisory for available workarounds.

Making our security policy clearer

Security testing continues to evolve, including through increasingly capable AI-assisted testing. These tools are making it possible to uncover combinations and edge cases that were previously difficult to identify.

As testing methods continue to advance, we want our approach to security to evolve with them. In the coming weeks, we will be updating the Highsoft Security Policy to make it clearer and better prepared for the future, with more explicit guidance on Highsoft’s responsibilities around security.

We encourage all Highcharts users to review the new security advisories and upgrade to the patched versions relevant to their implementation.

For questions about your implementation, contact [email protected].