highcharts vulnerabilities
CVEs whose affected-version data names the highcharts package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-118251High· 8.4Highcharts: `javascript:` URL in credits.href runs script on click
Highcharts: `javascript:` URL in credits.href runs script on click
CVE-2026-116796High· 7.2Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
CVE-2026-118244High· 7.2Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
CVE-2026-118246High· 8.4Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118249High· 7.2Highcharts: series column construction writes to Object.prototype
Highcharts: series column construction writes to Object.prototype
CVE-2026-118248Medium· 6.9Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableO…
CVE-2026-118250High· 7.2Highcharts: dotted series.keys paths write to Object.prototype
Highcharts: dotted series.keys paths write to Object.prototype