CVE Vulnerability Catalog

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state. This issue is fixed in Grid Pro 3.2.0.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.

In Highcharts Dashboards, the edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker controlling the Dashboards language configuration can supply markup with event handlers that execute in the hosting page origin when the sidebar is opened. This is fixed in 4.2.3.

In Highcharts prior to 11.4.9, 12.6.1, and 13.1.0, clicking the credits label assigns credits.href to the window location without validating the URL against the allowed-scheme list. An attacker controlling chart configuration can supply a javascript URL and execute script in the hosting page origin. Highcharts Stock, Maps, and Gantt are also affected as they ship from the same package.

When EAP runs with -secmgr, openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Highcharts JS from 6.1.0 until 11.4.9, 12.6.1, and 3.1.0 follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype, visible to all JavaScript in the page, with no user interaction beyond rendering the chart.

Highcharts JS from 13.0.0 until 13.1.0 builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor, affecting reads and for-in enumeration across the page without user interaction beyond rendering the chart.

Highcharts JS from 10.0.0 until 11.4.9, 12.6.1, and 13.1.0 applies breadcrumbs.style as SVG attributes rather than CSS and does not filter attribute names. An attacker who controls chart configuration can provide event-handler keys through breadcrumb options, which become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates and hovers over or activates the button.

Highcharts Dashboards from 1.0.0 until 4.2.2 uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes, and then markup and event handlers can execute in the hosting page origin when the board renders.

Highcharts JS from 12.0.0 until 12.6.1 and 13.1.0 falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document, and event handlers in that markup run in the page origin when printing begins.

Highcharts Grid creates SVG path elements from rendering.icons definitions and previously copied every child key with setAttribute. An attacker controlling Grid configuration can supply event-handler attribute names in an icon definition and replace default sort or pagination icons, causing script execution in the hosting page origin when a user hovers over or activates the icon. This is fixed in 3.2.0.

In Highcharts Grid Pro, input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker controlling column configuration can add event-handler attributes to every rendered row or to the edit control, causing script execution in the hosting page origin when a user hovers over, focuses, or begins editing. This is fixed in Grid Pro 3.2.0.

Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker controlling a chart text option can preserve a javascript URL in serialized chart output, and when exported or server-rendered SVG is parsed again and a user activates the link, script runs in that document's origin. This is fixed in 11.4.9, 12.6.2, and 13.1.1.

In RE2JS, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each start position, and Matcher-based APIs request capture slots that prevent early exit, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This is fixed in 2.8.7.

In russh, the agent server's Connection::try_sign path recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded success instead of calling Agent::confirm. A process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added via ssh-add -c without the required approval and authenticate or sign data as the user. This is fixed in 0.65.0.