CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Coreto a version that resolves this vulnerability.Fixed in 11.4.9 - Upgrade
Upgrade
Highcharts Coreto a version that resolves this vulnerability.Fixed in 12.6.1 - Upgrade
Upgrade
Highcharts Coreto a version that resolves this vulnerability.Fixed in 13.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected Highcharts Core versions are exposed when an attacker can control chart configuration containing drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical-series breadcrumb options. Styled-mode charts are not affected because they do not apply this option.
What user interaction is required for exploitation?
The user must navigate to a chart level that displays a breadcrumb button, then hover over or activate that button. The injected event-handler attribute executes in the hosting page's origin.
Which releases contain the fix?
The issue is fixed in Highcharts Core 11.4.9, 12.6.1, and 13.1.0.