WS-2020-0121 (High) detected in highcharts-3.0.9.js

[mend-bolt-for-github]

WS-2020-0121 - High Severity Vulnerability

Vulnerable Library - highcharts-3.0.9.js

Highcharts is a charting library written in pure JavaScript, offering an easy way of adding interactive charts to your web site or web application. Highcharts currently supports line, spline, area, areaspline, column, bar, pie and scatter chart types. Highcharts is NOT free for commercial use. See the license here: http://highcharts.com/license

Library home page: https://cdnjs.cloudflare.com/ajax/libs/highcharts/3.0.9/highcharts.js

Path to vulnerable library: /vendor/workerman/statistics/Applications/Statistics/Web/js/highcharts.js

Dependency Hierarchy:

• ❌ highcharts-3.0.9.js (Vulnerable Library)

Found in HEAD commit: 81f84f058af0cbca57ee22476557ded21c6813aa

Found in base branch: master

Vulnerability Details

highcharts before 8.1.1 is vulnerable to Cross-Site Scripting. An attacker can exacute arbitrary code from chart configuration string.

Publish Date: 2026-05-14

URL: WS-2020-0121

CVSS 3 Score Details (8.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1227

Release Date: 2020-06-09

Fix Resolution: highcharts - 7.2.2,8.1.1,thomasvargiu/laminas-twb-bundle - dev-fix/zf2,symfomany/laravelcinema - no_fix,tiderjian/think-core - v2.3.5,jianzi/runcms - no_fix,limesurvey/limesurvey - dev-dev-feature-api-add-quota-completeCount,daoke5/yii-plus - no_fix,maurolacerda-tech/ml-framework - no_fix,scylabs/neptune-bundle - no_fix,moszkva/cgraph - no_fix,kradpanel - no_fix,opencontent/ocsensor-ls - dev-statistic-collector,tiderjian/think-core - v13.0.0,ics/socialnetwork-bundle - 0.0.1,forkcms/forkcms - dev-dependabot/composer/ramsey/uuid-3.9.4,winmillwill/settings_compile - no_fix,sergeyugai/badpack - dev-dependabot/composer/symfony/http-kernel-5.4.20,tokalink/panel - no_fix,consynki/yii2-highcharts - no_fix,melibox/mercadolibre-php-sdk - no_fix,scylabs/neptune-bundle - v1.0.6,i9code/laravelmetronic - no_fix,cornernote/highcharts-assets - no_fix,highcharts - 7.2.2,scylabs/neptune-bundle - v1.1.9,drarko/meli-php-sdk - no_fix,shavy/qcache - v1.0.2,ivanbay/rosecomarketingventure - no_fix,facuramirez/mercado-libre-php-sdk - no_fix,stiki-asset/sisfo - no_fix,eher/phpunit - 1.0,zafranf/zetthcore - v0.1.0,abraxas81/charts - dev-analysis-8PoaGK,gosyl/common-bundle - 1.0,incodiy/codiy - no_fix,civicrm/civicrm-packages - 4.4.1,ogsteam/ogspy - dev-UpdateJSLibs2,ifcnv - no_fix,abraxas81/charts - 1.8.1,azuracast/azuracast - 0.9.5.1,maioradv/admin2-cdn - no_fix,42-9/neptune-bundle-menu - no_fix,scylabs/neptune-bundle - 1.3.1,winmillwill/settings_compile - 1.0.4,scylabs/neptune-bundle - v1.1.11,landrok/webstatus - no_fix,webscale/webscale - no_fix,2amigos/yiiwheels - no_fix,madephp/framework - no_fix,da/stat-bundle - no_fix,abraxas81/charts - dev-analysis-XNL37r,madpeterz/yetonemorephpframework - 4.2.1,pimientadigital/yii-booster - v2.0.0,edguy/admin_panel - 1.0,ogsteam/ogspy - 3.3.6,tiderjian/think-core - v8.0.1,kodicms/cms - no_fix,angular-highcharts - no_fix,highcharts - 8.1.1,truesocialmetrics/zf2-twb-bundle - 2.3.0,artic - 1.2.1,promet/settings_compile - no_fix,scylabs/neptune-bundle - v1.2.0,s-cart/s-cart - v1.0-beta,opencontent/ocsensor-ls - dev-user-settings,okaycms/okaycms - dev-feature/front_fixes,bjam-native - 1.73.0,jadu/pulsar - dev-dependabot/npm_and_yarn/tar-2.2.2,okaycms/okaycms - dev-revert-41-feature/add_delimeter_features_1c,aw/formfields - no_fix,hieupham0206/cloudteam-metronic - no_fix,itboye/sunsun_tcp - v2.0,opencontent/ocsensor-ls - dev-override-notification-type-target,yikesinc/yikes-inc-easy-mailchimp-extender - 5.1.0.1,n7consulting/jeyser-crm - no_fix,tiderjian/think-core - v11.34.0,hinkelmann/friga - no_fix,kingkernel/marrento - no_fix,mrs/sgv - no_fix,piwik/piwik - 2.0.4-b8,abraxas81/charts - 3.0,diablomedia/laminas-twb-bundle - dev-dependabot/composer/phpstan/phpstan-1.11.0,jadu/pulsar - dev-dependabot/npm_and_yarn/minimatch-and-mocha-3.1.2,arnulfosolis/qcharts - no_fix,opencontent/ocsensor-ls - dev-fix-perfomance,snide/travinizer-bundle - 1.1.0,limesurvey/limesurvey - 3.0.0+171222,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.7.0,tiderjian/think-core - v11.19.10,macweb/meli-php-sdk - dev-meli-v3.0.0,matomo/matomo - 2.0.4-b10,promet/settings_compile - 1.0.4,mwardi/highcharts-bundle - v1.1,splicephp/app - 3.0.0-RC1,s-money.api.wrapper - 1.0.2.3-alpha,matomo/matomo - 2.0.4-b8,zerkalica/phpunit - no_fix,zf2-boiler-app/app-messenger - no_fix,soq/linkmunch - no_fix,opencontent/openpa_agenda-ls - 1.26.0,tiderjian/qscmf - dev-rebuild1,laravel2016/charts - 1.8.1,novum/innovation-app-core - dev-temp-commit,madpeterz/yetonemorephpframework - 2.0.2,authorizit/authorizit - v1.0.0,jadu/pulsar - 1.0.19,abraxas81/charts - 5.0.1,whole/core - no_fix,boost - 1.71.0,opencontent/occhart-ls - 2.0.0,jonatasavila-mercadolibre/php-sdk - 1.0.0,laravel2016/charts - 3.0,opencontent/ocsensor-ls - dev-custom-policies-filter,jlaso/tradukoj - 1.1,scylabs/neptune-bundle - v1.0.7,loopeer/quickcms - no_fix,observableworker/observableworker - v3.1.1,fedorov-aleksey/yii2-package-theme-absolute-admin - v1.0.2,reedboat/yiiwheels - 1.0.0,tiderjian/think-core - v8.0.4,remp/crm-skeleton - 1.4.0,geek1992/tp5_rbac - 1.0.0,remp/crm-skeleton - 1.2.0,madpeterz/yetonemorephpframework - 4.1.1,opencontent/ocsensor-ls - dev-inbox,hatframework/hat-resource-charts - v0.3.2,piwik/piwik - dev-dependabot-github_actions-ncipollo-release-action-1.14.0,abraxas81/charts - dev-analysis-86GJ4W,wp-cloud/phpmemcacheadmin - 1.0.0,youshido/admin - 0.0.1,vaisakhshiva/php-code-coverage - 1.2.14,tiderjian/think-core - v12.0.5,2amigos/yiiwheels - 2.0.0,pbk83/csimpletable - v1.0,consoletvss/chartss - dev-analysis-qom0Bb,zyuyou/workerman - v3.1.1,scylabs/neptune-bundle - v1.1.10,tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/postcss-7.0.36,aerni/translator - dev-dependabot/npm_and_yarn/minimist-1.2.6,abraxas81/charts - dev-analysis-q1ZyJN,highcharts.js - 7.1.2,jadu/pulsar - dev-poc/twig3,dreamfactory/service-oauth - dev-feature/refactor,davehensley/highcharts - highstock-v1.0.1,opencontent/ocsensor-ls - dev-refactor-refresh,zymawy/ironside-core - dev-utils,scylabs/neptune-bundle - v1.0.9,okaycms/okaycms - dev-feature/fix_breadcrumbs_for_login_register_pass_remind,netbrain/highcharts-js - no_fix,pasoka/framework - no_fix,remp/crm-skeleton - 1.0.0,etdsolutions/highcharts - no_fix,tiderjian/think-core - v11.13.6,tiderjian/think-core - v12.0.0,miloschuman/yii2-highcharts-widget - v6.0,tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/ajv-6.12.6,nahapa/module-user - v0.0.1,kfilin/ksutils - no_fix,miloschuman/yii-highcharts - no_fix,scylabs/neptune-bundle - 1.2.13,tiderjian/think-core - v7.2.0,mshule/laravel-pipes - v1.2,maxiter/maxiter - no_fix,dotnet.highcharts - 2.0.0,sonsuzdongu/haller.php - no_fix,neilime/zf2-browscap - 1.1,hatframework/hat-resource-charts - no_fix,murrion/bullethq - no_fix,civicrm/civicrm-packages - 4.6.0,mikepsinn/php-highcharts-exporter - 1.0.3,jakabj16/yii2-highcharts-widget - 1.0.0,codeblanche/depend - 1.1.2,scylabs/neptune-bundle - v1.0.8,i9code/laravelmetronic2 - no_fix,truckee/projectmana - 3.0,jadu/pulsar - dev-dependabot/npm_and_yarn/docs/eta-and-docusaurus/core-and-docusaurus/preset-classic-2.0.0,limesurvey/limesurvey - dev-snyk-upgrade-3ddd041b50fb018d81e7711467a35e76,abouttheweb/zf2-twb-bundle - 2.3.0,kazist/kazist - 1.0.11,yuanling/workerman - 3.x-dev,dlin/saasu - v1.0.0,opencontent/ocsensor-ls - dev-chart2data,erik/laralum - no_fix,joegreen0991/fieldset - no_fix,opencontent/openpa_agenda-ls - dev-temp_luca,dreamfactory/oasys - dev-feature/refactor,carlescliment/query-builder - no_fix,truckee/projectmana - 4.0.0,neilime/zf2-mobile-detect - 2.0.0,vw/framework - v1.2.0,vw/framework - v1.0.0,madpeterz/yetonemorephpframework - 3.0.8,eher/phpunit - no_fix,jadu/pulsar - dev-twig-2.1,kisma/kisma - dev-master,moszkva/angie - no_fix,micheldamasceno/mercadolibre - no_fix,neilime/zf2-tree-layout-stack - 1.0,mrs/sgv - 2.9.8,dotnet.highcharts - no_fix,zhangyanxin1314/quickphp - no_fix,matomo/matomo - dev-dependabot-github_actions-ncipollo-release-action-1.14.0,bismark - 0.20.0,tiderjian/think-core - v11.x-dev,dyhhub/p - no_fix,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.7.1,n7consulting/jeyser-crm - 2.0.0-beta.1,macweb/meli-php-sdk - dev-test-bugs-resolved,kazist/kazist - no_fix,kmaking/admin-template - no_fix,ch4o5/x-tek_cmf - no_fix,geek1992/tp5_rbac - no_fix,friendsofvictoire/statistic-widget - no_fix,remp/crm-skeleton - no_fix,kohkimakimoto/earray - v2.0.0,raoul2000/yii-simple-workflow - no_fix,tiderjian/think-core - v11.30.4,adkgamers/bfadmincp - v2.0.0-rc.1,apace - no_fix,s-cart/s-cart - v6.7.4,eng-mmarouf/metronic - no_fix,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.6.1,jadu/pulsar - dev-dependabot/npm_and_yarn/hosted-git-info-2.8.9,dreamfactory/oasys - 0.1.2,s-cart/s-cart - no_fix,scylabs/neptune-bundle - v1.0.12,webeweb/highcharts-bundle - v1.0,melibox/mercadolibre-php-sdk - 1.0.3,consoletvss/chartss - dev-analysis-XNL37r,tellaw/sunshine-admin-bundle - v0.9.21,xdevelopers.web - no_fix,okaycms/okaycms - dev-feature/refactor_chpu_filter,xpanel - no_fix,consoletvss/chartss - dev-analysis-86GJ4W,meshood/cflash - v0.1,scylabs/neptune-bundle - v1.0.0,mwardi/highcharts-bundle - v1.3,csbill/csbill - 0.7.0,piwik/piwik - 2.0.4-b10,yinhe/yincart - no_fix,opencontent/ocsensor-ls - dev-criticals,consoletvss/chartss - 3.0,scelusswe/escaper - no_fix,letyii/yii2-chart - no_fix,pimientadigital/yii-booster - 1.0.5,n7consulting/jeyser-crm - v2.8.0,kfilin/ksutils - v1.0,elijaa/phpmemcacheadmin - 1.0.0,codeblanche/depend - 1.0.0rc1,scylabs/neptune-bundle - v1.0.1,ugly/form - no_fix,okaycms/okaycms - dev-feature/test_pr,mrchen/thriftrpc - no_fix,arionum/pool - no_fix,scylabs/neptune-bundle - v1.0.11,tellaw/sunshine-admin-bundle - v0.9.23,miloschuman/yii-highcharts - v0.4,arielcr/tipocambio-bccr - no_fix,2amigos/yiiwheels - 1.0.7-beta,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.6.2,grumpydictator/firefly-iii - dev-dependabot/composer/develop/doctrine/dbal-3.1.1,vw/framework - v1.0.8,i9code/laravelmetronic3 - no_fix,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.9.0,tiderjian/think-core - v3.1.2,kazist/kazist - 1.0.1,pan/quick-profiler - no_fix,walkor/workerman - 3.x-dev,zf2-boiler-app/app-db - no_fix,livestreet/plugin-admin - no_fix,fastd/asset-bundle - no_fix,tiderjian/think-core - v11.13.4,laravel2016/charts - 1.4,solidinvoice/solidinvoice - dev-dependabot/npm_and_yarn/moment-timezone-0.5.37,damnpoet/yiicart - no_fix,renderhighcharts.render - no_fix,shavy/s-array - v1.0.3,coffee/code-framework - 1.1,scalejs.highcharts - no_fix,tiderjian/qscmf - v2.0.0,highcharts - no_fix,nosh2/nosh2 - dev-dependabot/composer/guzzlehttp/guzzle-7.4.3,laraflat/laraflat - no_fix,clevertech/yii-booster - 1.0.5,mwardi/highcharts-bundle - v1.5,kalitte.dashboard.sampleapp - no_fix,abraxas81/charts - dev-analysis-qom0Bb,codefyphp/skeleton - v2.0.0,mothership-ec/cog-mothership-file-manager - dev-develop,hamichen/zf2-twb-bundle - 2.0,highcharts - 7.2.2,asherkin/throttle - v4.x-dev,opencontent/ocsensor-ls - dev-reports,sizannia/data-analytics-bundle - no_fix,tfarias/instalador-tfarias - no_fix,tiderjian/think-core - v12.0.8,bioconductor-fastqcleaner - no_fix,ics/socialnetwork-bundle - 1.0.15,miaoxing/stat - no_fix,flash20/yii2-adminh-asset - no_fix,igeekspace/twothink - no_fix,dcrphp/core - 1.0.7-alpha5,tiderjian/think-core - v11.33.4,zf2-boiler-app/app-logger - no_fix,boost - 1.73.0,adkgamers/bfadmincp - dev-dependabot/composer/guzzlehttp/guzzle-6.5.6,kevintcoughlin/citibike - no_fix,solidinvoice/solidinvoice - 0.7.0,tiderjian/think-core - dev-dependabot/npm_and_yarn/asset/libs/label-select/ssri-6.0.2,cgbin/cgblog - no_fix,highcharts - 8.1.1,okaycms/okaycms - dev-master,lizetheb1920/high-chart - no_fix,okaycms/okaycms - dev-feature/console_application,alejoasotelo/mercadolibre-php-sdk - no_fix,ogsteam/ogspy - dev-OGSpy_3.4,suitmedia/suitcoda - 1.0.0-beta0,lugosium/lugosiumovhvpsmonitorbundle - no_fix,moszkva/cgraph - v.2.2,getdevflow/cmf - no_fix,grimmlink/highcharts - v4.2.5,scylabs/neptune-bundle - v1.0.2,csoftech/cms - no_fix,grumpydictator/firefly-iii - dev-dependabot/composer/composer-a1e7ad0bd3,weiphpdev/weiphp5 - no_fix,consoletvss/chartss - dev-analysis-8PoaGK,remiheens/dbbalancer - no_fix,edguy/admin_panel - no_fix,scylabs/neptune-bundle - v1.1.5,truckee/projectmana - no_fix,scylabs/neptune-bundle - v1.1.6,alternatex/store - no_fix,gp247/core - no_fix,youshido/admin - no_fix,trash-panda/m2-opcache-monitor - no_fix,francodacosta/phmagick - no_fix,opencontent/ocsensor-ls - dev-master,lobostome/furry-bear - dev-master,r-highcharter - 0.5.0,zafranf/zetthcore - v0.4.39,junqing124/dcrphp - no_fix,rsoftech/role - v1.0.0,cheukpang/think-worker - v3.1.1,mango/cflash - no_fix,clevertech/yii-booster - v2.0.0,tiderjian/think-core - v11.34.7,apace - 1.0.2,whoosh/elaadmin - no_fix,mwardi/highcharts-bundle - no_fix,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.6.0,hahadu/php-device - v0.1.0,multiqc - 1.22,tomzx/anki-charts - no_fix,limesurvey/limesurvey - dev-scrutinizer-patch-1,lobostome/furry-bear - 0.7.2,kmaking/admin-template - v1.0.4,imagecms/imagecms - no_fix,shiyun/php-worker - no_fix,grumpydictator/firefly-iii - dev-dependabot/npm_and_yarn/develop/date-fns-3.0.6,codeblanche/depend - no_fix,alternatex/store - 1.0.1,dcoolweb.web.sw - no_fix,multiqc - 1.22,jdlabails/php-project-analyzer-bundle - 1.5.0,scylabs/neptune-bundle - v1.0.10,kazist/assets - 1.0.0,trungtnm/backend - 1.1,kazist/kazist - 1.0.15,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.8.0,dreamfactory/service-oauth - 0.1.2,hilioski/charts - 1.8.1,xristmas365/basic - no_fix,tiderjian/think-core - v11.13.10,xtgxiso/webworker - 0.1.3,bjam-native - 1.63.0,tiderjian/think-core - v11.34.3,husseinsayed/charts - no_fix,tellaw/sunshine-admin-bundle - v0.9.10,zerkalica/phpunit - dev-master,nosh2/nosh2 - no_fix,agapito78/php-sdk - no_fix,diablomedia/laminas-twb-bundle - 2.3.0,scylabs/neptune-bundle - v1.0.5,workerman/statistics - no_fix,forkcms/forkcms - dev-dependabot/composer/squizlabs/php_codesniffer-3.8.1,scylabs/neptune-bundle - v1.0.4,ogsteam/ogspy - 3.3.7-alpha5,opencontent/ocsensor-ls - 5.6.0,opencontent/openpa_agenda-ls - 1.28.1,abraxas81/charts - dev-add-code-of-conduct-1,icedevelop/layout-bundle - no_fix,thomasvargiu/laminas-twb-bundle - 2.3.0,brebvix/workerman - v3.1.1,zf2-boiler-app/app-access-control - no_fix,consoletvss/chartss - dev-analysis-zdnnkj,tiderjian/think-core - v11.30.0,mladindima/charts - 3.0,hai121341169/hai-thrift-rpc - no_fix,grumpydictator/firefly-iii - dev-dependabot/composer/develop/doctrine/dbal-3.1.4,topazcms/core - no_fix,rogeriopradoj/box-php52-codeigniter-skeleton - no_fix,tristanbes/elophant-bundle - no_fix,reedboat/yiiwheels - no_fix,ceman/mercadolibre-php-sdk - no_fix,trungtnm/backend - list,ifcnv - no_fix,consoletvss/chartss - dev-scrutinizer-patch-2,remp/crm-skeleton - 1.6.0,scylabs/neptune-bundle - v1.0.13,tungphan/yii-demo - no_fix,simonjodet/gumdrop - 1.2.0,michalwolinski/wbiztool-laravel - dev-dependabot/composer/symfony/http-foundation-4.4.7,crisnao2/meli - no_fix,grumpydictator/firefly-iii - dev-dependabot/composer/develop/laravel/sanctum-3.0.1,tfarias/instalador-tfarias - dev-master,forkcms/forkcms - dev-dependabot/composer/ramsey/uuid-3.9.6,limesurvey/limesurvey - dev-test-log-checks,mwardi/highcharts-bundle - v1.7-alpha,drupalchamp/crypto_distribution - no_fix,kingkernel/marrento - stable,shuwon/admin - 1.0.0,s-cart/s-cart - v6.5.0-beta,neilime/zf2-assets-bundle - 2.1,arnapou/gw2tools - 1.x-dev,vinala/kernel - dev-database-slowness-repairing,limesurvey/limesurvey - dev-travis-postgre,limesurvey/limesurvey - dev-fieldmap,jdlabails/php-project-analyzer-bundle - no_fix,khotim/yii2-highcharts - no_fix,zyblog/yii2-bjui - no_fix,cyzonetech/workerman - 3.x-dev,mango/cflash - v1.0,csoftech/customer - no_fix,zafranf/zetthcore - v0.4.35,magirc/magirc - v0.9.0,ogsteam/ogspy - no_fix,adkgamers/bfadmincp - no_fix,imagecms/imagecms - dev-phpunit,abraxas81/charts - dev-scrutinizer-patch-2,carlescliment/query-builder - v1.0.1,scylabs/neptune-bundle - v1.1.12,meshood/cflash - no_fix,scylabs/neptune-bundle - v1.1.7,prog/logger - no_fix,sunjiaqiang/codeigniter-integration - no_fix,2amigos/yii2-highcharts-widget - 1.0.0,usoftech/user - no_fix,zafranf/zetthcore - v0.5.0,opencontent/ocsensor-ls - dev-faq-predictor,okaycms/okaycms - dev-bugfix/xml_feed_helper_visible_features,imperiumclan/media-bundle - no_fix,galvani/cn-group-test - no_fix,brnskn/charts - 3.0,okaycms/okaycms - dev-bugfix/fix_rozetka_feed,kiyora/dashboard-generator - no_fix,scylabs/neptune-bundle - v1.1.8,boost - 1.75.0,scylabs/neptune-bundle - v1.0.3,kmaking/admin-template - v1.0.1,benborla/xampp - no_fix,fedorov-aleksey/yii2-package-theme-absolute-admin - no_fix,erik/laralum - 1.0,i9code/metronic - no_fix,gufy/assets-services - v1.1.3

---

Step up your Open Source Security Game with Mend here