---
title: "CVE-2021-29489"
canonical: "https://kb.cynergy.app/space/MD/923664627/CVE-2021-29489"
format: markdown
---
**Description**

Specific versions of [Highcharts](https://cve.report/software/highcharts/highcharts) from [Highcharts](https://cve.report/vendor/highcharts) contain the following vulnerability:

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions, 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.

**Published On**

05/05/2021

**Updated On**

06/03/2022

**Trending**

FALSE

**CWE**

<u>[CWE-79](http://cwe.mitre.org/data/definitions/79.html)</u>

**Exploit**


**Mitigation:**

![image](media://5fc9ce5d-ce25-486b-b36c-b75f1a2eb56f)

Cynergy has an automated mitigation capability that requires integration with your WAF provider.

Once integrated, you can request “Protect with WAF”

This will move the exposed asset behind WAF protection

<span style="color: #97a0af">**Note: **</span><span style="color: #97a0af">Policies configuration should be defined separately</span>

 

**Remediation**

In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.

As a workaround, Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.


**References**

|  |  |  |
| --- | --- | --- |
| CVE-2021-29489 Highcharts Vulnerability in NetApp Products | NetApp Product Security | [http://security.netapp.com](http://security.netapp.com)   
<span style="color: #ffffff">**text/html**</span> | ![URL Logo]() |
| Options structure open to XSS if passed unfiltered · Advisory · highcharts/highcharts · GitHub | [http://github.com](http://github.com)   
<span style="color: #ffffff">**text/html**</span> | ![URL Logo]() |