JavaScript Charting Library Vulnerability in Highcharts by Highsoft
CVE-2026-118246
8.4HIGH
What is CVE-2026-118246?
A vulnerability in Highcharts JS allows attackers to exploit unfiltered SVG attributes within breadcrumbs. Specifically, from versions 10.0.0 up to 11.4.9, 12.6.1, and 13.1.0, an attacker can manipulate chart configurations to introduce event-handler keys via drilldown and navigation breadcrumbs. These keys can then execute malicious scripts in the context of the user’s session upon interacting with breadcrumb buttons. This issue does not affect styled-mode charts, and it has been addressed in subsequent releases.
Affected Version(s)
highcharts >= 10.0.0, < 11.4.9 < 10.0.0, 11.4.9
highcharts >= 12.0.0, < 12.6.1 < 12.0.0, 12.6.1
highcharts >= 13.0.0, < 13.1.1 < 13.0.0, 13.1.1