Highcharts

Highcharts: Denial of Service

Highcharts Grid: pagination language options are parsed as HTML

Highcharts: javascript: URL in credits.href runs script on click

Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts Dashboards: sidebar component labels are parsed as HTML

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

Highcharts Grid: javascript: URL in credits.href runs script on click

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts: series column construction writes to Object.prototype

Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Highcharts: Cross-site Scripting

Highcharts: Prototype Pollution

Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Options structure open to XSS if passed unfiltered

also in 4 other products

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`