# highcharts (npm) vulnerabilities 8 known vulnerabilities (7 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 13.1.1 (Sep 20, 2026): no advisory affects it - Newest unaffected release: 13.1.1 (Sep 20, 2026), the latest release - Weekly downloads: 3.5M - Dependents: 38 - Releases: 126 since 0.0.1 (Aug 6, 2014) - Registry: https://www.npmjs.com/package/highcharts - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118251: 0.0.1 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it) - CVE-2026-118250: 6.1.0 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it) - CVE-2026-118249: 13.0.0 to 13.0.2 (13.1.0 is outside it) - CVE-2026-118246: 10.0.0 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it) - CVE-2026-118244: 12.0.0 to 12.6.0 (12.6.1 is outside it); 13.0.0 to 13.0.2 (13.1.0 is outside it) - CVE-2026-116796: 10.3.2 to 11.4.8 (11.4.9 is outside it); 12.0.0 to 12.6.1 (12.6.2 is outside it); 13.0.0 to 13.1.0 (13.1.1 is outside it) - CVE-2021-29489: 0.0.1 to 8.2.2 (9.0.0 is outside it) - CVE-2018-20801: 0.0.1 to 6.0.7 (6.1.0 is outside it) ## Advisories (8) ### [CVE-2026-118251](https://cve.now/CVE-2026-118251): Highcharts: javascript: URL in credits.href runs script on click - Severity: High 8.4 - Published: Oct 28, 2026 - Affected: fixed in 11.4.9; from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0. - Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 13.1.1, is not affected. - 74% of highcharts downloads last week were affected versions (3M). ### [CVE-2026-118250](https://cve.now/CVE-2026-118250): Highcharts: dotted series.keys paths write to Object.prototype - Severity: High 7.2 - Published: Oct 28, 2026 - Affected: from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0; from 6.1.0, fixed in 11.4.9. - Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 13.1.1, is not affected. - 73% of highcharts downloads last week were affected versions (3M). ### [CVE-2026-118249](https://cve.now/CVE-2026-118249): Highcharts: series column construction writes to Object.prototype - Severity: High 7.2 - Published: Oct 28, 2026 - Affected: from 13.0.0, fixed in 13.1.0. - Fixed in 13.1.0 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 13.1.1, is not affected. - 3.9% of highcharts downloads last week were affected versions (159.7K). ### [CVE-2026-118246](https://cve.now/CVE-2026-118246): Highcharts Core: \`breadcrumbs.style\` keys become SVG event-handler attributes - Severity: High 8.4 - Published: Oct 28, 2026 - Affected: from 10.0.0, fixed in 11.4.9; from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0. - Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 13.1.1, is not affected. - 58% of highcharts downloads last week were affected versions (2.4M). ### [CVE-2026-118244](https://cve.now/CVE-2026-118244): Highcharts Core: AST \`DOMParser\` fallback assigns unsanitized markup to \`innerHTML\` during print - Severity: High 7.2 - Published: Oct 28, 2026 - Affected: from 12.0.0, fixed in 12.6.1; from 13.0.0, fixed in 13.1.0. - Fixed in 12.6.1 (released Sep 20, 2026, 38 days before disclosure) and 13.1.0 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 13.1.1, is not affected. - 24% of highcharts downloads last week were affected versions (1M). ### [CVE-2026-116796](https://cve.now/CVE-2026-116796): Highcharts Core: \`javascript:\` URL in an \`xlink:href\` attribute survives text filtering and reaches exported charts - Severity: High 7.2 - Published: Oct 28, 2026 - Affected: from 10.3.2, fixed in 11.4.9; from 12.0.0, fixed in 12.6.2; from 13.0.0, fixed in 13.1.1. - Fixed in 11.4.9 (released Sep 25, 2026, 33 days before disclosure), 12.6.2 (released Sep 21, 2026, 37 days before disclosure) and 13.1.1 (released Sep 20, 2026, 38 days before disclosure). - The latest release, 13.1.1, is not affected. - 56% of highcharts downloads last week were affected versions (2.3M). ### [CVE-2021-29489](https://cve.now/CVE-2021-29489): Options structure open to XSS if passed unfiltered - Severity: High 7.6 - Published: May 5, 2021 - Affected: fixed in 9.0.0. - Fixed in 9.0.0 (released Feb 2, 2021, 92 days before disclosure). - The latest release, 13.1.1, is not affected. - 5.5% of highcharts downloads last week were affected versions (228.8K). ### [CVE-2018-20801](https://cve.now/CVE-2018-20801): In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a… - Severity: Unrated - Published: Mar 14, 2019 - Affected: fixed in 6.1.0. - Fixed in 6.1.0 (released Apr 13, 2018, 335 days before disclosure). - The latest release, 13.1.1, is not affected. - 1% of highcharts downloads last week were affected versions (42.4K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/highcharts Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.