CVE-2026-118251

HighCVSS 8.4

Published: 28/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

38th percentile - higher than 38% of all known CVEs

Summary

In Highcharts prior to 11.4.9, 12.6.1, and 13.1.0, clicking the credits label assigns credits.href to the window location without validating the URL against the allowed-scheme list. An attacker controlling chart configuration can supply a javascript URL and execute script in the hosting page origin. Highcharts Stock, Maps, and Gantt are also affected as they ship from the same package.

Risk Assessment

This enables arbitrary script execution (XSS) when a user clicks the credits label, potentially leading to session hijacking.

Recommendation

Update Highcharts (and Stock, Maps, Gantt) to version 11.4.9, 12.6.1, or 13.1.0 or later.

Other vulnerabilities in Highcharts

CVE-2026-116796High
Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker controlling a chart text option can preserve a javascript URL in serialized chart output, and when exported or server-rendered SVG is parsed again and a user activates the link, script runs in that document's origin. This is fixed in 11.4.9, 12.6.2, and 13.1.1.

Original NVD description (English source)

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS