High severity · published Oct 28, 2026
CVE-2026-116796
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
New
7.2
CVSS
–
EPSS
No
On KEV
Description
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
highcharts · highcharts
>= 10.3.2, < 11.4.9; >= 12.0.0, < 12.6.2; >= 13.0.0, < 13.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116796
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116796
x_refsource_CONFIRM
https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
x_refsource_MISC
https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88
x_refsource_MISC
https://github.com/highcharts/highcharts/releases/tag/v13.1.1
More from highcharts
8.6
CVE-2026-118254
Highcharts Grid: pagination language options are parsed as HTML
8.6
CVE-2026-118245
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
8.5
CVE-2026-118242
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
8.5
CVE-2026-116797
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
8.4
CVE-2026-118255
Highcharts Grid: javascript: URL in credits.href runs script on click