CVE-2026-116796
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.
| CWE | CWE-79 |
| Vendor | highcharts |
| Product | highcharts |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for highcharts highcharts
Be the first to know when new unknown vulnerabilities affecting highcharts highcharts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
highcharts / highcharts
>= 10.3.2, < 11.4.9 >= 12.0.0, < 12.6.2 >= 13.0.0, < 13.1.1