Cloudanix VulnDB

CVE-2026-116796

None

CVSS

—

EPSS

0.3%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A charting library let attackers hide scripts inside exported images so that clicking a link could run code in a user's browser until the software was updated.

Exploitation
Requires User Interaction
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Remote Code Execution
Component
Library
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Highcharts fails to apply scheme allow-listing to xlink:href attributes on SVG anchor elements, permitting javascript: URLs injected via chart text options to survive serialization and execute when the resulting SVG is re-parsed and the link is activated.

Why it matters to the business

Applications embedding charts risk cross-origin script execution in end-user browsers when exported or server-rendered SVGs are viewed, potentially exposing sensitive data or enabling account takeover until the library is updated.

How an attack unfolds

An attacker supplies a chart configuration containing a javascript: URL in an xlink:href attribute. The malicious value is preserved in exported SVG. When a victim loads the SVG and activates the link, the script executes in the document origin.

How to fix it

Upgrade Highcharts to version 11.4.9, 12.6.2, or 13.1.1 or later; regenerate any previously exported SVGs after the update.

How to confirm the fix worked

Confirm the installed version meets or exceeds a fixed release, then verify that javascript: URLs are stripped from xlink:href attributes during SVG export.

Typical attack path

  1. Supply untrusted input to a chart text option containing a javascript: URL in xlink:href
  2. Trigger SVG export or server-side rendering
  3. Deliver the resulting SVG to a victim
  4. Victim activates the embedded link, executing the script

How to detect it

Search application and export logs for SVG content containing javascript: schemes inside xlink:href attributes; review chart serialization events for unexpected URL patterns.

  • xlink:href="javascript:
  • xlink:href='javascript:

What your security team should do

  • Upgrade Highcharts to 11.4.9, 12.6.2, or 13.1.1 immediately
  • Audit all chart data sources for untrusted text options
  • Block or sanitize SVG exports containing javascript: schemes until patched

The record

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities