Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116796 · Microsoft / collected KEV context

EUVD-2026-112279

GHSA-mw4f-gj5x-6xr4

cve-program · CVE-2026-116796

• https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
• https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88
• https://github.com/highcharts/highcharts/releases/tag/v13.1.1

euvd · EUVD-2026-112279

• https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
• https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88
• https://github.com/highcharts/highcharts/releases/tag/v13.1.1

nvd · CVE-2026-116796

• https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88
• https://github.com/highcharts/highcharts/releases/tag/v13.1.1
• https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4

osv · GHSA-mw4f-gj5x-6xr4

• https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4
• https://nvd.nist.gov/vuln/detail/CVE-2026-116796
• https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88
• https://github.com/highcharts/highcharts
• https://github.com/highcharts/highcharts/releases/tag/v13.1.1

• Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker wh… · Advisory content revised · 5 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker wh… · Advisory content revised · 3 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker wh… · Advisory content revised · 30 Oct 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker wh… · Advisory content revised · 30 Oct 2026
• Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts · Newly collected advisory · 28 Oct 2026
• Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts · Newly collected advisory · 28 Oct 2026