Script Injection Vulnerability in Highcharts JavaScript Charting Library
CVE-2026-118251
8.4HIGH
What is CVE-2026-118251?
A security vulnerability in the Highcharts JavaScript charting library can result in script injection. If a user clicks the credits label in charts before versions 11.4.9, 12.6.1, and 13.1.0, the library allows unvalidated URLs to open, potentially leading to execution of malicious scripts hosted on an attacker-controlled site. This vulnerability affects Highcharts, Highcharts Stock, Highcharts Maps, and Highcharts Gantt, necessitating immediate update to versions that mitigate this issue.
Affected Version(s)
highcharts < 11.4.9 < 11.4.9
highcharts >= 12.0.0, < 12.6.1 < 12.0.0, 12.6.1
highcharts >= 13.0.0, < 13.1.1 < 13.0.0, 13.1.1