Cross-Site Scripting in Highcharts JS Library by Highcharts
CVE-2026-118244
7.2HIGH
What is CVE-2026-118244?
The Highcharts JS library, a popular JavaScript charting solution, has a vulnerability that arises when DOMParser fails to parse a document, allowing raw markup to be assigned to innerHTML without adequate sanitization. This becomes particularly risky during the printing process, where maliciously crafted HTML can be introduced, enabling the execution of event handlers in the context of the page's origin. The vulnerability affects HTML-rendered components such as titles and labels in charts and is present in versions from 12.0.0 to 12.6.1 and 13.1.0. Users are advised to update to the fixed versions to mitigate this threat.
Affected Version(s)
highcharts >= 12.0.0, < 12.6.1 < 12.0.0, 12.6.1
highcharts >= 13.0.0, < 13.1.0 < 13.0.0, 13.1.0