Read the docs
TI-2026-82124 Aliases CVE-2026-116796GHSA-mw4f-gj5x-6xr4

Cross-site scripting in Highcharts Core through SVG xlink:href links

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Highcharts JS from 10.3.2 before 11.4.9, from 12.0.0 before 12.6.2 and from 13.0.0 before 13.1.1 accepts an SVG anchor xlink:href attribute without the allowed-scheme check used for href and src. This flaw (CWE-79) lets a javascript URL survive text filtering in chart text options. An attacker who controls a chart text option needs a user to activate the link in exported or server-rendered SVG, and then script runs in the origin of that document.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Partial highcharts (highcharts): 11.4.9, 12.6.2, 13.1.1highcharts (npm): 11.4.9, 12.6.2, 13.1.1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighcharts10.3.2 to before 11.4.9; 12.0.0 to before 12.6.2; 13.0.0 to before 13.1.111.4.9, 12.6.2, 13.1.1Patch availableCNA
—highcharts (npm)10.3.2 to before 11.4.911.4.9Patch availableGHSA-mw4f-gj5x-6xr4
—highcharts (npm)12.0.0 to before 12.6.212.6.2Patch availableGHSA-mw4f-gj5x-6xr4
—highcharts (npm)13.0.0 to before 13.1.113.1.1Patch availableGHSA-mw4f-gj5x-6xr4
  • highcharts Vendorhighcharts Affected 10.3.2 to before 11.4.9; 12.0.0 to before 12.6.2; 13.0.0 to before 13.1.1 Fixed in 11.4.9, 12.6.2, 13.1.1 Patch available CNA
  • highcharts (npm) Vendor— Affected 10.3.2 to before 11.4.9 Fixed in 11.4.9 Patch available GHSA-mw4f-gj5x-6xr4
  • highcharts (npm) Vendor— Affected 12.0.0 to before 12.6.2 Fixed in 12.6.2 Patch available GHSA-mw4f-gj5x-6xr4
  • highcharts (npm) Vendor— Affected 13.0.0 to before 13.1.1 Fixed in 13.1.1 Patch available GHSA-mw4f-gj5x-6xr4

Remediation

Update the highcharts npm package to 11.4.9, 12.6.2 or 13.1.1, matching your release line. Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 and Red Hat Enterprise Linux AI 3 as affected, with no fix available yet.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA highcharts (highcharts) Fixed in 11.4.9, 12.6.2, 13.1.1
  • Fix · GHSA-mw4f-gj5x-6xr4 highcharts (npm) Fixed in 11.4.9 Advisory →
  • Fix · GHSA-mw4f-gj5x-6xr4 highcharts (npm) Fixed in 12.6.2 Advisory →
  • Fix · GHSA-mw4f-gj5x-6xr4 highcharts (npm) Fixed in 13.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-116796
  2. 2026-10-28 Alias added: GHSA-mw4f-gj5x-6xr4
  3. 2026-10-28 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] · GHSA-mw4f-gj5x-6xr4
  4. 2026-10-28 CVSS score added · GHSA-mw4f-gj5x-6xr4
  5. 2026-10-28 Weakness changed · GHSA-mw4f-gj5x-6xr4
  6. 2026-10-28 5 new references · GHSA-mw4f-gj5x-6xr4
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-10-30 CVSS score added · Red Hat

References

Advisory 1

Other 4

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences