CVE-2026-118246 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Highcharts JS versions from 10.0.0 through specific patched releases represents a significant security flaw rooted in improper input validation within the library's SVG rendering engine. Highcharts is widely used for data visualization, and this particular issue arises when the application processes configuration objects that define breadcrumb navigation elements. In non-styled mode charts, which rely on direct attribute manipulation rather than CSS classes, the library fails to sanitize or filter specific property names provided by the user in drilldown configurations. This lack of sanitization allows an attacker who controls the chart configuration payload to inject arbitrary JavaScript event handler keys directly into the SVG attributes of breadcrumb buttons. The technical mechanism involves the library treating these injected keys as valid attribute assignments without verifying their safety, thereby bypassing standard security expectations for DOM manipulation within a client-side rendering context.
From a technical perspective, this flaw constitutes an instance of Cross-Site Scripting (XSS) facilitated by insecure deserialization or improper validation of configuration parameters. The Common Weakness Enumeration categorizes this under CWE-79, which describes Improper Neutralization of Input During Web Page Generation. By injecting event handler attributes such as onclick or onmouseover into SVG elements via the drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options, an attacker can execute arbitrary JavaScript code within the security context of the hosting page. This is particularly dangerous because the executed scripts run with full privileges of the victim user and the origin domain where Highcharts is embedded, rather than being sandboxed to a restricted scope typical of some data visualization libraries. The vulnerability specifically targets non-styled mode charts; styled-mode implementations that apply CSS classes instead of direct SVG attributes are not susceptible to this specific attack vector because they do not pass untrusted configuration keys directly into the DOM attribute layer in the same manner.
The operational impact of this vulnerability is severe, as it enables remote code execution within the context of any web page utilizing a vulnerable version of Highcharts JS where an attacker can influence the chart's initial configuration or update its state dynamically. Once triggered by user interaction such as hovering over or activating a breadcrumb button after navigating to a specific level, the injected script executes immediately. This allows for data exfiltration, session hijacking through cookie theft, defacement of the host application, or further pivoting into internal networks if the hosting page has access to sensitive resources. The attack requires user interaction but is relatively straightforward given that many charting applications allow dynamic configuration updates based on API responses or user inputs without sufficient validation.
Mitigation strategies primarily involve upgrading to patched versions of Highcharts JS, specifically version 11.4.9, 12.6.1, and 13.1.0, which address the input filtering deficiency. For environments where immediate patching is not feasible, developers should enforce strict allow-lists for configuration properties passed to chart initialization functions, ensuring that only expected keys are processed. Additionally, utilizing styled-mode charts instead of default attribute-based styling can serve as a defensive workaround since this attack vector does not apply when CSS classes are used exclusively. Implementing Content Security Policy (CSP) headers with restrictive script-src directives can also mitigate the impact by preventing the execution of injected inline scripts or external resources that do not match approved sources, thereby reducing the effectiveness of any successful XSS exploitation attempt.