CVE-2026-118244
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Highcharts JS from 12.0.0 until 12.6.1 and 13.1.0 falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document, and event handlers in that markup run in the page origin when printing begins.
Risk Assessment
This could lead to execution of malicious JavaScript in the user's page context, such as data theft or performing actions on behalf of the user.
Recommendation
Update Highcharts to version 12.6.1 or 13.1.0, which fix the vulnerability.
Other vulnerabilities in Highcharts JS
See all- CVE-2026-118250High
Highcharts JS from 6.1.0 until 11.4.9, 12.6.1, and 3.1.0 follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype, visible to all JavaScript in the page, with no user interaction beyond rendering the chart.
- CVE-2026-118249High
Highcharts JS from 13.0.0 until 13.1.0 builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor, affecting reads and for-in enumeration across the page without user interaction beyond rendering the chart.
- CVE-2026-118246High
Highcharts JS from 10.0.0 until 11.4.9, 12.6.1, and 13.1.0 applies breadcrumbs.style as SVG attributes rather than CSS and does not filter attribute names. An attacker who controls chart configuration can provide event-handler keys through breadcrumb options, which become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates and hovers over or activates the button.
Original NVD description (English source)
Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS