Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-118244 · Microsoft / collected KEV context

EUVD-2026-112307

GHSA-65hg-cf3f-5m39

cve-program · CVE-2026-118244

• https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
• https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5
• https://github.com/highcharts/highcharts/releases/tag/v13.1.0

euvd · EUVD-2026-112307

• https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
• https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5
• https://github.com/highcharts/highcharts/releases/tag/v13.1.0

nvd · CVE-2026-118244

• https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5
• https://github.com/highcharts/highcharts/releases/tag/v13.1.0
• https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39

osv · GHSA-65hg-cf3f-5m39

• https://github.com/highcharts/highcharts/security/advisories/GHSA-65hg-cf3f-5m39
• https://nvd.nist.gov/vuln/detail/CVE-2026-118244
• https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5
• https://github.com/highcharts/highcharts
• https://github.com/highcharts/highcharts/releases/tag/v13.1.0

• Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chrom… · Advisory content revised · 5 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chrom… · Advisory content revised · 3 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chrom… · Advisory content revised · 30 Oct 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chrom… · Advisory content revised · 30 Oct 2026
• Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print · Newly collected advisory · 28 Oct 2026
• Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing · Newly collected advisory · 28 Oct 2026