npmPackage

highcharts

8 known vulnerabilities (7 high), with the versions each affects and the releases that fix them.

Latest release: 13.1.1 (Sep 20, 2026): no advisory affects it
Newest unaffected release: 13.1.1 (Sep 20, 2026), the latest release
Advisories: 8 · 7 high

Weekly downloads: 3.5M
Dependents: 38
Releases: 126 since 0.0.1 (Aug 6, 2014)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-118251
Affects 0.0.1 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it)
CVE-2026-118250
Affects 6.1.0 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it)
CVE-2026-118249
Affects 13.0.0 to 13.0.2 (13.1.0 is outside it)
CVE-2026-118246
Affects 10.0.0 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it)
CVE-2026-118244
Affects 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it)
CVE-2026-116796
Affects 10.3.2 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.1 (12.6.2 is outside it); 13.0.0 to 13.1.0 (13.1.1 is outside it)
CVE-2021-29489
Affects 0.0.1 to 8.2.2 (9.0.0 is outside it)
CVE-2018-20801
Affects 0.0.1 to 6.0.7 (6.1.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-118251High 8.4
Highcharts: javascript: URL in credits.href runs script on click
Affected: fixed in 11.4.9; from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0.
Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure).
The latest release, 13.1.1, is not affected.
74% of highcharts downloads last week were affected versions (3M).
CVE-2026-118250High 7.2
Highcharts: dotted series.keys paths write to Object.prototype
Affected: from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0; from 6.1.0, fixed in 11.4.9.
Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure).
The latest release, 13.1.1, is not affected.
73% of highcharts downloads last week were affected versions (3M).
CVE-2026-118249High 7.2
Highcharts: series column construction writes to Object.prototype
Affected: from 13.0.0, fixed in 13.1.0.
Fixed in 13.1.0 (released Sep 18, 2026, 40 days before disclosure).
The latest release, 13.1.1, is not affected.
3.9% of highcharts downloads last week were affected versions (159.7K).
CVE-2026-118246High 8.4
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
Affected: from 10.0.0, fixed in 11.4.9; from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0.
Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure).
The latest release, 13.1.1, is not affected.
58% of highcharts downloads last week were affected versions (2.4M).
CVE-2026-118244High 7.2
Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
Affected: from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0.
Fixed in 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure).
The latest release, 13.1.1, is not affected.
24% of highcharts downloads last week were affected versions (1M).
CVE-2026-116796High 7.2
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
Affected: from 10.3.2, fixed in 11.4.9; from 12.0.0, fixed in 12.6.2; from 13.0.0, fixed in 13.1.1.
Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.2 (released Sep 21, 2026, 37 days before disclosure) and 13.1.1 (released Sep 20, 2026, 38 days before disclosure).
The latest release, 13.1.1, is not affected.
56% of highcharts downloads last week were affected versions (2.3M).
CVE-2021-29489High 7.6
Options structure open to XSS if passed unfiltered
Affected: fixed in 9.0.0.
Fixed in 9.0.0 (released Feb 2, 2021, 92 days before disclosure).
The latest release, 13.1.1, is not affected.
5.5% of highcharts downloads last week were affected versions (228.8K).
CVE-2018-20801Unrated
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a…
Affected: fixed in 6.1.0.
Fixed in 6.1.0 (released Apr 13, 2018, 335 days before disclosure).
The latest release, 13.1.1, is not affected.
1% of highcharts downloads last week were affected versions (42.4K).