{"id":"EUVD-2026-112279","enisaUuid":"e77dbe0c-922c-3f6c-a25a-7a433140a64e","description":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.","datePublished":"Oct 28, 2026, 5:23:02 PM","dateUpdated":"Oct 28, 2026, 5:23:02 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4\nhttps://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.1\n","aliases":"CVE-2026-116796\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"081ffa15-3ff3-37a0-b071-681953a042f3","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"10.3.2, \u003c 11.4.9"},{"id":"734411e2-3a06-3fa9-8a0b-f240829771c1","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"12.0.0, \u003c 12.6.2"},{"id":"d034b1f1-07a5-379b-b0bc-106c50c71d29","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"13.0.0, \u003c 13.1.1"}],"enisaIdVendor":[{"id":"8e01305f-61d5-3fe4-b7c4-5f0ce9f7fabb","vendor":{"name":"highcharts"}}],"enisaIdVulnerability":[{"id":"fbc95775-d0cd-3bf0-a8c5-05c69bfe9b3c","vulnerability":{"id":"CVE-2026-116796","description":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.","datePublished":"Oct 28, 2026, 5:23:02 PM","dateUpdated":"Oct 28, 2026, 5:23:02 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4\nhttps://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.1\n","enisa_id":"EUVD-2026-112279\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 10:00:17 PM","vulnerabilityProduct":[{"id":"43a4da0c-75e9-3e10-9c62-fe77cb723919","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"12.0.0, \u003c 12.6.2"},{"id":"c37817f0-ca65-3f22-a81e-632b9108c12e","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"13.0.0, \u003c 13.1.1"},{"id":"ca47e5d4-c03f-3eba-98b2-e2757dee0688","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"10.3.2, \u003c 11.4.9"}],"vulnerabilityVendor":[{"id":"174c432d-e066-356c-a097-a5f58c683fce","vendor":{"name":"highcharts"}}]}}],"enisaIdAdvisory":[]}