CERT24GHSA-6hgp-fmhr-mrg4 — Highcharts Grid: `javascript:` URL in credits.href runs script on clickLoading data…
CERT24Threat Observatory
Period

GHSA-6hgp-fmhr-mrg4 — Highcharts Grid: `javascript:` URL in credits.href runs script on click

An attacker who controls the Grid configuration can set credits.href to a `javascript:` URL. When a user activates the link, attacker-supplied script runs in the origin of the page hosting the Grid.

← Back to intelligence

GHSA-6hgp-fmhr-mrg4 — Highcharts Grid: `javascript:` URL in credits.href runs script on click

An attacker who controls the Grid configuration can set credits.href to a `javascript:` URL. When a user activates the link, attacker-supplied script runs in the origin of the page hosting the Grid.