CVE-2026-118246 · GHSA-35rr-xwfh-x789
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
- Risk score
- 55/100
- CVSS
- 8.4 v4.0
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadc…
- Affected
- highcharts (npm) >= 10.0.0, < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2
- Fix
- Upgrade highcharts to 11.4.9 or 12.6.1 or 13.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
highcharts: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadc…
The flaws
- CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (CVSS 8.4)
- CVE-2026-118251: Highcharts: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
- CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (CVSS 7.2)
- CVE-2026-118244: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing (CVSS 7.2)
The fix
Upgrade highcharts: 11.4.9 · 12.6.1 · 13.1.0 · 12.6.2 · 13.1.1 or later on your release line
Who is exposed: highcharts (npm) >= 10.0.0, < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 400 other warnings in 30 days
Why it is Yellow
- CVSS 8.4 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| highcharts | npm | >= 10.0.0, < 11.4.9 | 11.4.9 |
| highcharts | npm | >= 12.0.0, < 12.6.1 | 12.6.1 |
| highcharts | npm | >= 13.0.0, <= 13.0.2 | 13.1.0 |
References
- https://github.com/highcharts/highcharts/commit/b0fafdaaee7d0cac2ecfeb0eaf37b11cd40594ef
- https://github.com/highcharts/highcharts/releases/tag/v13.1.0
- https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789
- https://github.com/advisories/GHSA-35rr-xwfh-x789
- https://nvd.nist.gov/vuln/detail/CVE-2026-118246
- https://github.com/advisories/GHSA-35rr-xwfh-x789
Original description
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Last activity 28 Oct 2026. Patch Forecast updates every hour.