Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-116796EUVD-2026-112279GHSA-MW4F-GJ5X-6XR4

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 11.4.9, 12.6.2, 13.1.1
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Highcharts JS, a JavaScript charting library that renders SVG charts, is affected. The flaw lets a malicious `javascript:` link survive in exported or server-rendered chart SVG, so if a user opens that SVG and clicks the link, attacker-supplied script can run in the context of the document's origin.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • highcharts highcharts

    From 10.3.2 · fixed in 11.4.9; From 12.0.0 · fixed in 12.6.2; From 13.0.0 · fixed in 13.1.1

  • highchartsnpm

    From 10.3.2 · fixed in 11.4.9

  • highchartsnpm

    From 12.0.0 · fixed in 12.6.2

  • highchartsnpm

    From 13.0.0 · fixed in 13.1.1

References 3

GitHub · highcharts/highcharts