CVE Vulnerability Catalog

In Highcharts prior to 11.4.9, 12.6.1, and 13.1.0, clicking the credits label assigns credits.href to the window location without validating the URL against the allowed-scheme list. An attacker controlling chart configuration can supply a javascript URL and execute script in the hosting page origin. Highcharts Stock, Maps, and Gantt are also affected as they ship from the same package.

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allows a local attacker to perform arbitrary read/write via a malicious file.

When EAP runs with -secmgr, openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

A user with read access to Grafana's server logs or a log store they are shipped to can recover OAuth and OIDC access, refresh, and ID tokens of users signing in through Generic OAuth, Google, or GitLab providers. Grafana writes these tokens unredacted when a token is not a valid JWT, when the ID token is missing (at debug level), or is not a string. Exposure is bounded by the scopes granted to the OAuth client.

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder. A remote attacker operating a public dedicated server can crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length, causing remote denial of service.

Highcharts JS from 6.1.0 until 11.4.9, 12.6.1, and 3.1.0 follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype, visible to all JavaScript in the page, with no user interaction beyond rendering the chart.

Highcharts JS from 13.0.0 until 13.1.0 builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor, affecting reads and for-in enumeration across the page without user interaction beyond rendering the chart.

Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker controlling editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype, affecting JavaScript throughout the page. This is fixed in 4.2.2.

Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can write integer-indexed values onto Object.prototype or the Object constructor, affecting array and object reads and for-in enumeration throughout the page. This is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.

Highcharts JS from 10.0.0 until 11.4.9, 12.6.1, and 13.1.0 applies breadcrumbs.style as SVG attributes rather than CSS and does not filter attribute names. An attacker who controls chart configuration can provide event-handler keys through breadcrumb options, which become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates and hovers over or activates the button.

Highcharts Dashboards from 1.0.0 until 4.2.2 uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes, and then markup and event handlers can execute in the hosting page origin when the board renders.

Highcharts JS from 12.0.0 until 12.6.1 and 13.1.0 falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document, and event handlers in that markup run in the page origin when printing begins.

Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, creating an enumerable property visible on every object that can throw and break features such as extremes synchronization. The issue affects versions 1.0.0 through 4.2.2 and is fixed in 4.2.2.

Highcharts Grid creates SVG path elements from rendering.icons definitions and previously copied every child key with setAttribute. An attacker controlling Grid configuration can supply event-handler attribute names in an icon definition and replace default sort or pagination icons, causing script execution in the hosting page origin when a user hovers over or activates the icon. This is fixed in 3.2.0.

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The parser can wait indefinitely for a valid chunk-size line while each add() grows the buffer.

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. A basename made of many dots ending in a backslash causes quadratic matching time.

In Highcharts Grid Pro, input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker controlling column configuration can add event-handler attributes to every rendered row or to the edit control, causing script execution in the hosting page origin when a user hovers over, focuses, or begins editing. This is fixed in Grid Pro 3.2.0.

Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker controlling a chart text option can preserve a javascript URL in serialized chart output, and when exported or server-rendered SVG is parsed again and a user activates the link, script runs in that document's origin. This is fixed in 11.4.9, 12.6.2, and 13.1.1.

In RE2JS, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each start position, and Matcher-based APIs request capture slots that prevent early exit, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This is fixed in 2.8.7.

In russh, the agent server's Connection::try_sign path recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded success instead of calling Agent::confirm. A process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added via ssh-add -c without the required approval and authenticate or sign data as the user. This is fixed in 0.65.0.