CVE-2026-116796

    Dashboard / Vulnerabilities / CVE-2026-116796

    CVE-2026-116796

    Published: 28 Oct 2026Last Modified: 31 Oct 2026

    Summary: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

    Details: Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

    References: https://github.com/highcharts/highcharts/releases/tag/v13.1.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116796.json, https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4, https://nvd.nist.gov/vuln/detail/CVE-2026-116796, https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e44b0e19db9affdb85b667524365d268c314b957
    Fixed -81b13135ebaf3a2bedc9383b7f4aa84bde77eda6

    Affected versions

    v13.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-116796 | CVE-DB