CVE-2026-116796

HighCVSS 7.2

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker controlling a chart text option can preserve a javascript URL in serialized chart output, and when exported or server-rendered SVG is parsed again and a user activates the link, script runs in that document's origin. This is fixed in 11.4.9, 12.6.2, and 13.1.1.

Risk Assessment

Potential arbitrary script execution (XSS) in the context of the document where the exported SVG is embedded or displayed. Risk applies to applications exporting or server-rendering charts with untrusted text options.

Recommendation

Update Highcharts to version 11.4.9, 12.6.2, or 13.1.1 (or later). Do not allow untrusted users to control chart text options.

Other vulnerabilities in Highcharts

CVE-2026-118251High
In Highcharts prior to 11.4.9, 12.6.1, and 13.1.0, clicking the credits label assigns credits.href to the window location without validating the URL against the allowed-scheme list. An attacker controlling chart configuration can supply a javascript URL and execute script in the hosting page origin. Highcharts Stock, Maps, and Gantt are also affected as they ship from the same package.

Original NVD description (English source)

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS