{"id":"CVE-2026-116796","title":"Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts","summary":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker…","severity":"high","cvss":7.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"highcharts","product":"highcharts","affected":["highcharts >= 10.3.2, < 11.4.9","highcharts >= 12.0.0, < 12.6.2","highcharts >= 13.0.0, < 13.1.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T18:34:49.411209Z"},"published":"2026-10-28","updated":"2026-10-29","sourceUpdated":"2026-10-29T18:34:59.207Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116796","references":[{"url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4","label":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4"},{"url":"https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88","label":"https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88"},{"url":"https://github.com/highcharts/highcharts/releases/tag/v13.1.1","label":"https://github.com/highcharts/highcharts/releases/tag/v13.1.1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116796"},{"url":"https://github.com/advisories/GHSA-mw4f-gj5x-6xr4"}],"tags":["cve.org","ghsa","npm"],"aliases":["GHSA-mw4f-gj5x-6xr4"],"ecosystem":"npm","patched":["highcharts 11.4.9","highcharts 12.6.2","highcharts 13.1.1"],"epss":0.00337,"epssPercentile":0.27161,"ingestedAt":"2026-10-28T18:15:46.395Z","slug":"CVE-2026-116796","body":"## Overview\n\nHighcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.\n\n## Affected\n\n- `highcharts >= 10.3.2, < 11.4.9`\n- `highcharts >= 12.0.0, < 12.6.2`\n- `highcharts >= 13.0.0, < 13.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-116796)\n\nAffected packages:\n\n- `highcharts >= 10.3.2, < 11.4.9`\n- `highcharts >= 12.0.0, < 12.6.2`\n- `highcharts >= 13.0.0, <= 13.1.0`\n\nPatched in:\n\n- `highcharts 11.4.9`\n- `highcharts 12.6.2`\n- `highcharts 13.1.1`\n\nSource: https://github.com/advisories/GHSA-mw4f-gj5x-6xr4","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}