What is GHSA-xmc8-cjfr-phx3?

GHSA-xmc8-cjfr-phx3 is a security advisory published by GitHub Security Advisories with High severity. Regular Expression Denial of Service in highcharts

Which CVE IDs does GHSA-xmc8-cjfr-phx3 cover?

GHSA-xmc8-cjfr-phx3 covers the following CVE IDs: CVE-2018-20801. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xmc8-cjfr-phx3?

GHSA-xmc8-cjfr-phx3 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-xmc8-cjfr-phx3?

GHSA-xmc8-cjfr-phx3 affects 1 product, including: npm/highcharts:\u003c 6.1.0.

GHSA-xmc8-cjfr-phx3HighCVSS 7.5

Regular Expression Denial of Service in highcharts

Vendor

GitHub Security Advisories

Published

March 18, 2019

Last Modified

April 11, 2023

🔗 CVE IDs covered (1)

CVE-2018-20801 →

📋 Description

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 6.1.0 or higher.

🎯 Affected products1

npm/highcharts:< 6.1.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-20801
https://github.com/highcharts/highcharts/commit/7c547e1e0f5e4379f94396efd559a566668c0dfa
https://github.com/advisories/GHSA-xmc8-cjfr-phx3
https://www.npmjs.com/advisories/793
https://snyk.io/vuln/npm:highcharts:20180225
https://security.netapp.com/advisory/ntap-20190715-0001/