CVE-2026-118251 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
Highcharts JS is a widely adopted JavaScript charting library that leverages SVG for rendering visual data representations across web applications. The vulnerability identified affects versions prior to 11.4.9, 12.6.1, and 13.1.0, encompassing not only the core Highcharts library but also its specialized variants such as Highcharts Stock, Maps, and Gantt, which are distributed within the same package structure. This broad scope means that any web application utilizing these libraries for data visualization is potentially susceptible to this flaw if they have not yet upgraded to a patched version. The issue stems from how the library handles user interactions with specific UI elements, particularly the credits label that typically appears in chart interfaces to attribute authorship or licensing information.
The technical root cause of this vulnerability lies in the improper validation of URL schemes when handling click events on the credits element. Specifically, when a user clicks the credits label, Highcharts assigns the value of the href property directly to the window location without performing adequate sanitization checks against an allowed scheme list. In secure web development practices, any dynamic assignment of URLs that result in navigation or script execution must be strictly validated to ensure they do not contain malicious protocols such as javascript: or data:. By failing to enforce this restriction, the library allows arbitrary JavaScript code injection through a controlled configuration parameter. This represents a classic case of insufficient input validation where trusted UI components are used as vectors for executing untrusted scripts within the context of the hosting page.
From an operational impact perspective, this vulnerability enables Cross-Site Scripting attacks against users interacting with affected charts. An attacker who has control over the chart configuration data can embed a malicious javascript URL in the credits href attribute. When a victim user clicks on the credits label to view attribution details or navigate away from the chart, the browser executes the injected script within the origin of the hosting page. This allows the attacker to perform actions such as stealing session cookies, hijacking user sessions, defacing the website content, or redirecting users to phishing sites. Because the script runs in the context of the original domain, it bypasses same-origin policy protections that would otherwise limit the scope of damage from cross-domain scripts.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, within the MITRE ATT&CK framework, this behavior corresponds to techniques involving client-side code injection and potentially command execution via browser APIs. The attack vector is classified as local because it requires some level of control over the chart configuration or data input provided by an administrator or a user with write access to the application settings. However, if such configurations are stored in databases accessible through other vulnerabilities like SQL injection, the scope expands significantly.
To mitigate this risk, organizations must immediately upgrade Highcharts and its associated packages to version 11.4.9, 12.6.1, or 13.1.0 where these issues have been resolved by implementing proper URL scheme validation before assigning values to window location. For applications that cannot be updated instantly due to compatibility constraints, a temporary workaround involves manually sanitizing any user-supplied URLs used in chart configurations to ensure they do not contain javascript: or data: schemes. Additionally, developers should implement Content Security Policy headers with strict directives regarding script sources and frame ancestors to limit the impact of successful exploitation even if input validation fails. Regular security audits of third-party library usage and configuration management processes are essential to prevent similar misconfigurations in dynamic web applications.