CVE-2026-118246

What it actually does

Highcharts applies unfiltered breadcrumb.style keys as SVG attributes on drilldown elements, allowing event-handler attributes (e.g., onclick) supplied via drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series options to register as active handlers that execute JavaScript in the hosting page origin when the breadcrumb is hovered or activated. Styled-mode charts are unaffected.

Why it matters to the business

Organizations embedding Highcharts charts with user-influenced or externally sourced configuration risk cross-site scripting that can expose session data, perform unauthorized actions, or deface pages viewed by end users. The issue affects recent library releases and requires prompt upgrade to avoid exposure in production dashboards.

How an attack unfolds

An attacker who can influence chart configuration objects supplies malicious event-handler keys inside breadcrumb style definitions. When a victim navigates through drilldown levels and interacts with the rendered breadcrumb element, the injected handlers fire in the page context, executing attacker-controlled JavaScript without further user interaction beyond normal chart use.

How to fix it

Upgrade Highcharts to version 11.4.9, 12.6.1, 13.1.0, or later. Where immediate upgrade is not feasible, disable drilldown or hierarchical series features, avoid styled-mode off configurations that consume the breadcrumbs.style option, and sanitize all configuration objects before passing them to the chart constructor.

How to confirm the fix worked

Confirm the installed Highcharts version meets or exceeds 11.4.9 / 12.6.1 / 13.1.0. Test by supplying a configuration containing an onclick handler in any of the listed breadcrumb paths and verify that no handler attribute is rendered on the DOM element and that no script executes on interaction.

Typical attack path

1. Identify or compromise a source that supplies Highcharts configuration (API response, database record, or client-side object).
2. Inject event-handler attribute names and payloads into the breadcrumbs.style, drilldown.breadcrumbs, navigation.breadcrumbs, or series breadcrumb options.
3. Cause the victim page to render the chart and trigger drilldown navigation.
4. Wait for user hover or activation of the breadcrumb element to execute the injected handler in the page origin.

How to detect it

Search application source repositories and runtime configuration stores for breadcrumb style objects containing keys that begin with on (onclick, onmouseover, etc.). Monitor web server or application logs for chart rendering requests that include drilldown or hierarchical series parameters with suspicious attribute-like values. No persistent artifacts are expected after exploitation.

What your security team should do

• Immediately inventory all applications using Highcharts 10.x through 11.4.8, 12.x before 12.6.1, or 13.x before 13.1.0 and schedule upgrades within the next sprint.
• Add automated dependency scanning and version pinning for the Highcharts package in build pipelines.
• Review any code paths that construct chart options from untrusted input and enforce strict allow-listing of breadcrumb configuration keys.