{"id":"CVE-2018-20801","aliases":["CLSA-2026-1780620684","CLSA-2026-1780620685","CLSA-2026-1782867610","CLSA-2026-1782867611","CLSA-2026-1782867614","CLSA-2026-1782867618","CLSA-2026-1787823889","EUVD-2019-0398","GHSA-6chw-6frg-f759","GHSA-gr4j-r575-g665","GHSA-xmc8-cjfr-phx3"],"status":"published","title":"Regular Expression Denial of Service in Acorn","description":"In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03169,"percentile":0.88102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-185","CWE-400","CWE-79"],"published":"2019-03-14T16:00:00Z","modified":"2026-11-05T13:28:24Z","fixes":[{"ecosystem":"npm","package":"acorn","fixed_in":["6.4.1","7.1.1","5.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"highcharts","fixed_in":["7.2.2","8.1.1","6.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"acorn","fixed_in":["6.0.4-tuxcare.1","6.2.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"highcharts","fixed_in":["6.1.0-tuxcare.1","6.0.7-tuxcare.1","6.1.3-tuxcare.1","7.2.0-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.4-tuxcare.0"},{"fixed":"6.0.4-tuxcare.1"}]}],"versions":["6.0.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"acorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0-tuxcare.0"},{"fixed":"6.2.0-tuxcare.1"}]}],"versions":["6.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0-tuxcare.0"},{"fixed":"6.1.0-tuxcare.1"}]}],"versions":["6.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7-tuxcare.0"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.3-tuxcare.0"},{"fixed":"6.1.3-tuxcare.1"}]}],"versions":["6.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0-tuxcare.0"},{"fixed":"7.2.0-tuxcare.1"}]}],"versions":["7.2.0"]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"5.5.0"},{"fixed":"5.7.4"}]}]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"acorn","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"highcharts","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"highcharts","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"highcharts","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.0"}]}]}],"products":[{"vendor":"highcharts","product":"highcharts"}],"references":[{"url":"https://snyk.io/vuln/npm:highcharts:20180225","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/highcharts/highcharts/commit/7c547e1e0f5e4379f94396efd559a566668c0dfa","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190715-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://github.com/acornjs/acorn/issues/929","tags":["web"]},{"url":"https://github.com/acornjs/acorn/commit/793c0e569ed1158672e3a40aeed1d8518832b802","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-ACORN-559469","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1488","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6chw-6frg-f759"},{"url":"https://github.com/highcharts/highcharts/issues/13559","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-HIGHCHARTS-571995","tags":["web"]},{"url":"https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gr4j-r575-g665"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20801","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xmc8-cjfr-phx3","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/793","tags":["web"]},{"url":"https://github.com/highcharts/highcharts","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20190715-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-20801","description":"In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.","status":"published","published":"2019-03-14T16:00:00Z","modified":"2024-08-05T12:12:28.318Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2019-0398","description":"In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.","status":"published","published":"2019-03-14T16:00:00Z","modified":"2024-08-05T12:12:28Z","updated_at":"2026-11-03T02:39:29.769885Z"}],"ghsa":[{"id":"GHSA-6chw-6frg-f759","title":"Regular Expression Denial of Service in Acorn","description":"Affected versions of acorn are vulnerable to Regular Expression Denial of Service.\nA regex in the form of /[x-\\ud800]/u causes the parser to enter an infinite loop.\nThe string is not valid UTF16 which usually results in it being sanitized before reaching the parser.\nIf an application processes untrusted input and passes it directly to acorn,\nattackers may leverage the vulnerability leading to Denial of Service.","status":"published","published":"2020-04-03T21:48:38Z","modified":"2023-01-09T05:02:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:03.040255Z"},{"id":"GHSA-gr4j-r575-g665","title":"Cross-Site Scripting in highcharts","description":"Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.","status":"published","published":"2020-08-25T14:04:47Z","modified":"2023-11-10T18:07:19Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:19.438667Z"},{"id":"GHSA-xmc8-cjfr-phx3","title":"Regular Expression Denial of Service in highcharts","description":"Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 6.1.0 or higher.","status":"published","published":"2019-03-18T15:59:32Z","modified":"2023-04-11T00:23:51Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:36:50.476488Z"}],"nvd":[{"id":"CVE-2018-20801","description":"In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.","status":"published","published":"2019-03-14T16:29:00.243Z","modified":"2026-06-17T01:53:30.173Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"CVE-2018-20801","description":"In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.","status":"published","published":"2019-03-14T16:29:00.243Z","modified":"2026-10-20T10:51:23.208016603Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"GHSA-6chw-6frg-f759","title":"Regular Expression Denial of Service in Acorn","description":"Affected versions of acorn are vulnerable to Regular Expression Denial of Service.\nA regex in the form of /[x-\\ud800]/u causes the parser to enter an infinite loop.\nThe string is not valid UTF16 which usually results in it being sanitized before reaching the parser.\nIf an application processes untrusted input and passes it directly to acorn,\nattackers may leverage the vulnerability leading to Denial of Service.","status":"published","published":"2020-04-03T21:48:38Z","modified":"2021-08-23T15:10:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"GHSA-gr4j-r575-g665","title":"Cross-Site Scripting in highcharts","description":"Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.","status":"published","published":"2020-08-25T14:04:47Z","modified":"2023-11-10T18:07:18Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GHSA-xmc8-cjfr-phx3","title":"Regular Expression Denial of Service in highcharts","description":"Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 6.1.0 or higher.","status":"published","published":"2019-03-18T15:59:32Z","modified":"2023-11-08T04:00:12.772702Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"CLSA-2026-1780620684","title":"TuxCare security update for acorn (1 CVE)","description":"TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-30T19:45:55.719094904Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780620685","title":"TuxCare security update for acorn (1 CVE)","description":"TuxCare rebuilt acorn to address 1 CVE. Fixed in 6.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-30T19:45:54.384369162Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782867610","title":"TuxCare security update for highcharts (1 CVE)","description":"TuxCare rebuilt highcharts to address 1 CVE. Fixed in 6.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-11-05T13:28:22.674931482Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1782867611","title":"TuxCare security update for highcharts (2 CVEs)","description":"TuxCare rebuilt highcharts to address 2 CVEs. Fixed in 6.0.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-11-05T13:28:20.741460967Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1782867614","title":"TuxCare security update for highcharts (1 CVE)","description":"TuxCare rebuilt highcharts to address 1 CVE. Fixed in 6.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-11-05T13:28:24.575983847Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1782867618","title":"TuxCare security update for highcharts (1 CVE)","description":"TuxCare rebuilt highcharts to address 1 CVE. Fixed in 7.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-11-05T13:28:24.747811327Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1787823889","title":"TuxCare security update for tar (6 CVEs)","description":"TuxCare rebuilt tar to address 6 CVEs. Fixed in 6.2.0-tuxcare.1.","status":"withdrawn","published":"2026-08-27T09:44:49Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}