Every CVE Search/ Get API key

CVE-2018-20801

Regular Expression Denial of Service in Acorn

7.5 HighFix available

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.17%Down 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Record
CVE-2018-20801
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-185
Updated
2026-11-02
CVE List No score

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Record
CVE-2018-20801
Updated
2026-11-02
EUVDEUVD-2019-0398 No score

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Record
EUVD-2019-0398
Updated
2026-11-03
GitHub AdvisoriesGHSA-6chw-6frg-f759 7.5

Regular Expression Denial of Service in Acorn

Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.

Record
GHSA-6chw-6frg-f759
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
GitHub AdvisoriesGHSA-gr4j-r575-g665 8.7

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.

Record
GHSA-gr4j-r575-g665
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-xmc8-cjfr-phx3 7.5

Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 6.1.0 or higher.

Record
GHSA-xmc8-cjfr-phx3
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
Show 11 moreShow less
OSV 7.5

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.

Record
CVE-2018-20801
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-6chw-6frg-f759 7.5

Regular Expression Denial of Service in Acorn

Affected versions of acorn are vulnerable to Regular Expression Denial of Service. A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly to acorn, attackers may leverage the vulnerability leading to Denial of Service.

Record
GHSA-6chw-6frg-f759
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-gr4j-r575-g665 8.7

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.

Record
GHSA-gr4j-r575-g665
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-xmc8-cjfr-phx3 7.5

Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Recommendation

Upgrade to version 6.1.0 or higher.

Record
GHSA-xmc8-cjfr-phx3
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVCLSA-2026-1780620684 No score

TuxCare security update for acorn (1 CVE)

TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.0.4-tuxcare.1.

Record
CLSA-2026-1780620684
Updated
2026-11-02
OSVCLSA-2026-1780620685 No score

TuxCare security update for acorn (1 CVE)

TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.2.0-tuxcare.1.

Record
CLSA-2026-1780620685
Updated
2026-11-02
OSVCLSA-2026-1782867610 No score

TuxCare security update for highcharts (1 CVE)

TuxCare rebuilt highcharts to address 1 CVE. Fixed in 6.1.0-tuxcare.1.

Record
CLSA-2026-1782867610
Updated
2026-11-05
OSVCLSA-2026-1782867611 No score

TuxCare security update for highcharts (2 CVEs)

TuxCare rebuilt highcharts to address 2 CVEs. Fixed in 6.0.7-tuxcare.1.

Record
CLSA-2026-1782867611
Updated
2026-11-05
OSVCLSA-2026-1782867614 No score

TuxCare security update for highcharts (1 CVE)

TuxCare rebuilt highcharts to address 1 CVE. Fixed in 6.1.3-tuxcare.1.

Record
CLSA-2026-1782867614
Updated
2026-11-05
OSVCLSA-2026-1782867618 No score

TuxCare security update for highcharts (1 CVE)

TuxCare rebuilt highcharts to address 1 CVE. Fixed in 7.2.0-tuxcare.1.

Record
CLSA-2026-1782867618
Updated
2026-11-05
OSVCLSA-2026-1787823889 No score

TuxCare security update for tar (6 CVEs)

TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.2.0-tuxcare.1.

Record
CLSA-2026-1787823889
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
acorn
npm
 6.0.0 up to 6.4.1
6.4.1
acorn
npm
 7.0.0 up to 7.1.1
7.1.1
acorn
npm
 5.5.0 up to 5.7.4
5.7.4
highcharts
npm
 before 7.2.2
7.2.2
highcharts
npm
 8.0.0 up to 8.1.1
8.1.1
highcharts
npm
 before 6.1.0
6.1.0
acorn
TuxCare:npm
 6.0.4-tuxcare.0 up to 6.0.4-tuxcare.1, plus listed versions
6.0.4
6.0.4-tuxcare.1
acorn
TuxCare:npm
 6.2.0-tuxcare.0 up to 6.2.0-tuxcare.1, plus listed versions
6.2.0
6.2.0-tuxcare.1
highcharts
TuxCare:npm
 6.1.0-tuxcare.0 up to 6.1.0-tuxcare.1, plus listed versions
6.1.0
6.1.0-tuxcare.1
highcharts
TuxCare:npm
 6.0.7-tuxcare.0 up to 6.0.7-tuxcare.1, plus listed versions
6.0.7
6.0.7-tuxcare.1
highcharts
TuxCare:npm
 6.1.3-tuxcare.0 up to 6.1.3-tuxcare.1, plus listed versions
6.1.3
6.1.3-tuxcare.1
highcharts
TuxCare:npm
 7.2.0-tuxcare.0 up to 7.2.0-tuxcare.1, plus listed versions
7.2.0
7.2.0-tuxcare.1

History

History
RecordedChangedSources
affected, aliases, cwes, facts, references, titleOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-20801 is a high vulnerability (CVSS 7.5) in Highcharts, published March 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.17%, the 88th percentile. Fixed in acorn 6.4.1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open