CVE-2026-116796 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 10.3.2 through specific releases up to 11.4.9, 12.6.2, and 13.1.1 represents a significant cross-site scripting risk rooted in inconsistent input validation logic for SVG attributes. As a widely adopted JavaScript charting library that relies on Scalable Vector Graphics for rendering visualizations, Highcharts processes various user-supplied inputs to generate dynamic charts. The core technical flaw lies in the handling of anchor elements within serialized SVG output. Specifically, while the library correctly applies scheme-based filtering to standard href and src attributes to prevent the execution of malicious scripts via javascript: URLs, it fails to apply this same allowed-scheme check to the xlink:href attribute. This inconsistency creates a bypass mechanism where an attacker who controls chart text options can inject or preserve a javascript URL within the xlink:href property during serialization.
From a technical perspective, SVG anchor elements utilize xlink:href for hyperlinks in older SVG specifications and certain rendering contexts. When Highcharts serializes chart data into SVG format, it processes these attributes to ensure security compliance. However, because the validation logic was not extended to cover xlink:href, any javascript: protocol embedded within this attribute remains intact in the final output. This oversight is particularly dangerous when the generated SVG is exported or server-rendered and subsequently parsed by a web browser. If an end-user interacts with the chart, such as clicking on text associated with the vulnerable anchor element, the browser interprets the xlink:href value as executable code rather than a standard hyperlink destination.
The operational impact of this vulnerability allows for remote cross-site scripting attacks against users viewing the affected charts. When the malicious javascript URL is activated, it executes within the security context and origin of the document containing the chart. This enables attackers to perform actions such as stealing session cookies, hijacking user sessions, defacing web pages, or redirecting users to phishing sites. The severity is amplified by the fact that Highcharts is often used in dashboards and data visualization tools where trusted content is displayed; therefore, users may not suspect malicious code execution originating from a chart component. This behavior aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting, specifically highlighting the failure to validate URL schemes against an allowlist.
To mitigate this risk, organizations must ensure that all instances of Highcharts are updated to version 11.4.9 or later for the legacy branch, or versions 12.6.2 and 13.1.1 and above for newer branches. These releases include patches that extend the allowed-scheme validation logic to cover xlink:href attributes, thereby neutralizing javascript: URLs before they can be serialized into SVG output. For environments where immediate patching is not feasible, defensive measures should include implementing strict Content Security Policy headers that restrict script execution origins and prevent inline scripts from running unless explicitly whitelisted. Additionally, input sanitization at the application layer to strip or encode potentially dangerous URL schemes in chart configuration data can provide an additional layer of defense against exploitation attempts targeting this specific vector.