Cloudanix VulnDB

CVE-2026-118251

None

CVSS

—

EPSS

0.4%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A charting tool used on websites can be tricked into running harmful code on a visitor's browser if someone supplies a bad link in the chart's credit label and the visitor clicks it.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows cross-site scripting by assigning an attacker-supplied javascript: URL from credits.href directly to window.location without validating against the permitted scheme list, executing arbitrary script in the hosting page origin upon credits label click.

Why it matters to the business

Attackers can steal session data, perform actions as the user, or deface the application when users interact with rendered charts, increasing risk of data exposure or unauthorized activity in applications using the charting library.

How an attack unfolds

An attacker who can control or inject chart configuration data supplies a javascript: URL in the credits.href field; when a victim loads the chart and clicks the credits label, the browser executes the script in the page's origin without further checks.

How to fix it

Upgrade Highcharts (including Stock, Maps, and Gantt) to version 11.4.9, 12.6.1, or 13.1.0 or later; review and sanitize any dynamically supplied chart configuration before rendering.

How to confirm the fix worked

Confirm deployed library version matches or exceeds 11.4.9/12.6.1/13.1.0; test that javascript: URLs in credits.href are rejected and only allowed schemes execute; review configuration sanitization logic.

Typical attack path

  1. Identify or compromise a page that renders attacker-controlled Highcharts configuration
  2. Craft malicious chart options containing a javascript: URL in credits.href
  3. Serve or inject the chart so a victim user views and interacts with it
  4. Victim clicks the credits label, triggering script execution in page context

How to detect it

Inspect application logs or telemetry for unexpected navigation events originating from chart credit clicks; search rendered page source or configuration stores for javascript: schemes in credits objects; review client-side error or navigation logs for anomalies tied to chart interactions.

  • javascript: in chart credits configuration
  • credits.href assignment to window.location

What your security team should do

  • Prioritize upgrade of Highcharts packages to fixed releases within standard change windows given low EPSS and recent publication
  • Audit all locations where chart configuration is sourced from user input or external data
  • Implement server-side or client-side sanitization of credits fields as defense-in-depth
  • Monitor for new exploit maturity signals or KEV inclusion

The record

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities