Cross-Site Scripting in Highcharts JS by Highsoft
CVE-2026-116796
7.2HIGH
What is CVE-2026-116796?
Highcharts JS, a widely-used JavaScript charting library, has a security issue where it accepts an SVG anchor xlink:href attribute without properly validating the scheme. This vulnerability affects versions ranging from 10.3.2 through 11.4.8, 12.6.0 to 12.6.1, and 13.1.0. An attacker can manipulate chart text options to include malicious JavaScript URLs, which, when activated by a user, execute scripts in the context of the document. Fortunately, the issue has been addressed in versions 11.4.9, 12.6.2, and 13.1.1.
Affected Version(s)
highcharts >= 10.3.2, < 11.4.9 < 10.3.2, 11.4.9
highcharts >= 12.0.0, < 12.6.2 < 12.0.0, 12.6.2
highcharts >= 13.0.0, < 13.1.1 < 13.0.0, 13.1.1