Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118251 · GHSA-5793-x2q3-c3q7

Highcharts: `javascript:` URL in credits.href runs script on click

Risk score
55/100
CVSS
8.4 v4.0
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL …
Affected
highcharts (npm) < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2
Fix
Upgrade highcharts to 11.4.9 or 12.6.1 or 13.1.0 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: highchartsTHE FLAWSTHE FIXCVE-2026-118251Highcharts: `javascript:` URLin credits.href runs script onclickCVSS 8.4CVE-2026-118246Highcharts Core:`breadcrumbs.style` keysbecome SVG event-handler…CVSS 8.4CVE-2026-116796Highcharts Core: `javascript:`URL in an `xlink:href`attribute survives text…CVSS 7.2CVE-2026-118244Highcharts Core: HTML textparsing falls back to unfiltered`innerHTML` during printingCVSS 7.2Upgrade highcharts11.4.9 · 12.6.1 · 13.1.0 · 12.6.2 ·13.1.1or later on your release lineWho is exposedhighcharts (npm) < 11.4.9;highcharts (npm) >= 12.0.0, <12.6.1; highcharts (npm) >=13.0.0, <= 13.0.2YELLOW · PLAN IT INhighchartsHighcharts JS is a JavaScriptcharting library based on SVG.Prior to 11.4.9, 12.6.1, and 13.1.0,Highcharts assigns credits.hrefto the window location when thecredits label is clicked withoutchecking the URL against the…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

highcharts: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL …

The flaws

  • CVE-2026-118251: Highcharts: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
  • CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (CVSS 8.4)
  • CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (CVSS 7.2)
  • CVE-2026-118244: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing (CVSS 7.2)

The fix

Upgrade highcharts: 11.4.9 · 12.6.1 · 13.1.0 · 12.6.2 · 13.1.1 or later on your release line

Who is exposed: highcharts (npm) < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.4 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
highchartsnpm< 11.4.911.4.9
highchartsnpm>= 12.0.0, < 12.6.112.6.1
highchartsnpm>= 13.0.0, <= 13.0.213.1.0

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.