CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Q: Who is exposed to this issue?

Deployments using Highcharts versions from 10.3.2 up to, but not including, 11.4.9, 12.6.2, or 13.1.1 are affected if an attacker can control a chart text option and the resulting chart SVG is exported or server-rendered and later parsed.

Q: What must an attacker do for script execution to occur?

The attacker needs control over a chart text option to introduce a javascript: URL in an SVG anchor xlink:href attribute. A user must then activate that link after the exported or server-rendered SVG is parsed again; the script executes in that document's origin.

Q: How can this be remediated?

Upgrade Highcharts to 11.4.9, 12.6.2, 13.1.1, or a later fixed release in the applicable release line.

Q: What can be done if an upgrade is not immediately possible?

Prevent untrusted parties from controlling chart text options, and avoid distributing or re-parsing exported or server-rendered SVG that may contain attacker-controlled chart text. Review serialized SVG output for anchor xlink:href values using the javascript: scheme.

Published Oct 28, 2026

Updated

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

Affected Software

1 affected component

Highsoft Highcharts Core>=10.3.2<11.4.9, >=12.0.0<12.6.2, >=13.0.0<13.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Highcharts JS to a version that resolves this vulnerability.
Fixed in 11.4.9
Upgrade
Upgrade Highcharts JS to a version that resolves this vulnerability.
Fixed in 12.6.2
Upgrade
Upgrade Highcharts JS to a version that resolves this vulnerability.
Fixed in 13.1.1

Event History

Oct 28, 2026

CVE Published

via MITRE·05:23 PM

Data Sourced

via MITRE·05:23 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments using Highcharts versions from 10.3.2 up to, but not including, 11.4.9, 12.6.2, or 13.1.1 are affected if an attacker can control a chart text option and the resulting chart SVG is exported or server-rendered and later parsed.

What must an attacker do for script execution to occur?

The attacker needs control over a chart text option to introduce a javascript: URL in an SVG anchor xlink:href attribute. A user must then activate that link after the exported or server-rendered SVG is parsed again; the script executes in that document's origin.

How can this be remediated?

Upgrade Highcharts to 11.4.9, 12.6.2, 13.1.1, or a later fixed release in the applicable release line.

What can be done if an upgrade is not immediately possible?

Prevent untrusted parties from controlling chart text options, and avoid distributing or re-parsing exported or server-rendered SVG that may contain attacker-controlled chart text. Review serialized SVG output for anchor xlink:href values using the javascript: scheme.

CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do for script execution to occur?

How can this be remediated?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do for script execution to occur?

How can this be remediated?

What can be done if an upgrade is not immediately possible?