CVE-2026-118244 · GHSA-65hg-cf3f-5m39

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Risk score: 48/100
CVSS: 7.2 v4.0
Published: 28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so …
Affected: highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2
Fix: Upgrade highcharts to 12.6.1 or 13.1.0 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

highcharts: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadc…

The flaws

CVE-2026-118244: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing (CVSS 7.2)
CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (CVSS 8.4)
CVE-2026-118251: Highcharts: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (CVSS 7.2)

The fix

Upgrade highcharts: 12.6.1 · 13.1.0 · 11.4.9 · 12.6.2 · 13.1.1 or later on your release line

Who is exposed: highcharts (npm) >= 10.0.0, < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2

Where it stands

No known exploitation

Connects to

Same weakness: Cross-site scripting (CWE-79). 400 other warnings in 30 days

Why it is Yellow

CVSS 7.2 high
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
highcharts	npm	>= 12.0.0, < 12.6.1	12.6.1
highcharts	npm	>= 13.0.0, <= 13.0.2	13.1.0

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.