Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M
CVE-2026-118246Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
High 8.4
In plain English
A high-severity cross-site scripting in highcharts from highcharts. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | highcharts | 11.4.9 | GHSA-35rr-xwfh-x789 |
| npm | highcharts | 12.6.1 | GHSA-35rr-xwfh-x789 |
| npm | highcharts | 13.1.0 | GHSA-35rr-xwfh-x789 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| highcharts | highcharts | >= 10.0.0, < 11.4.9>= 12.0.0, < 12.6.1>= 13.0.0, < 13.1.1 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N