{"id":"EUVD-2026-112279","enisaUuid":"e77dbe0c-922c-3f6c-a25a-7a433140a64e","description":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.","datePublished":"Oct 28, 2026, 5:23:02 PM","dateUpdated":"Oct 29, 2026, 6:34:59 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4\nhttps://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.1\n","aliases":"CVE-2026-116796\nGHSA-mw4f-gj5x-6xr4\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"081ffa15-3ff3-37a0-b071-681953a042f3","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"10.3.2, \u003c 11.4.9"},{"id":"734411e2-3a06-3fa9-8a0b-f240829771c1","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"12.0.0, \u003c 12.6.2"},{"id":"d034b1f1-07a5-379b-b0bc-106c50c71d29","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"13.0.0, \u003c 13.1.1"}],"enisaIdVendor":[{"id":"8e01305f-61d5-3fe4-b7c4-5f0ce9f7fabb","vendor":{"name":"highcharts"}}],"enisaIdVulnerability":[{"id":"7a03398b-a7e8-3b54-aa15-f010e30d805f","vulnerability":{"id":"GHSA-mw4f-gj5x-6xr4","description":"Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts","datePublished":"Oct 28, 2026, 7:55:10 PM","dateUpdated":"Oct 28, 2026, 7:55:10 PM","baseScore":0.0,"references":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116796\nhttps://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88\nhttps://github.com/highcharts/highcharts\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.1\n","enisa_id":"EUVD-2026-112279\n","aliases":"CVE-2026-116796\nGHSA-mw4f-gj5x-6xr4\n","epss":0.0,"dataProcessed":"Nov 3, 2026, 7:03:11 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fbc95775-d0cd-3bf0-a8c5-05c69bfe9b3c","vulnerability":{"id":"CVE-2026-116796","description":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.","datePublished":"Oct 28, 2026, 5:23:02 PM","dateUpdated":"Oct 29, 2026, 6:34:59 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4\nhttps://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.1\n","enisa_id":"EUVD-2026-112279\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 3, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"43a4da0c-75e9-3e10-9c62-fe77cb723919","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"12.0.0, \u003c 12.6.2"},{"id":"c37817f0-ca65-3f22-a81e-632b9108c12e","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"13.0.0, \u003c 13.1.1"},{"id":"ca47e5d4-c03f-3eba-98b2-e2757dee0688","product":{"name":"highcharts","vendor":{"name":"highcharts"}},"product_version":"10.3.2, \u003c 11.4.9"}],"vulnerabilityVendor":[{"id":"174c432d-e066-356c-a097-a5f58c683fce","vendor":{"name":"highcharts"}}]}}],"enisaIdAdvisory":[]}