{"id":"CVE-2026-116796","summary":"Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts","details":"Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.","aliases":["GHSA-mw4f-gj5x-6xr4"],"modified":"2026-10-29T02:48:26.322810684Z","published":"2026-10-28T17:23:02.604Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116796.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"10.3.2"},{"fixed":"11.4.9"},{"introduced":"12.0.0"},{"fixed":"12.6.2"}]}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116796.json"},{"type":"FIX","url":"https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88"},{"type":"WEB","url":"https://github.com/highcharts/highcharts/releases/tag/v13.1.1"},{"type":"ADVISORY","url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-mw4f-gj5x-6xr4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116796"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/highcharts/highcharts","events":[{"introduced":"e44b0e19db9affdb85b667524365d268c314b957"},{"fixed":"81b13135ebaf3a2bedc9383b7f4aa84bde77eda6"},{"fixed":"6cf359fb144aa51fdc105e2b9bbd013439b02c88"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"13.0.0"},{"fixed":"13.1.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"6cf359fb144aa51fdc105e2b9bbd013439b02c88"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v13.1.1","range":[{"fixed":"81b13135ebaf3a2bedc9383b7f4aa84bde77eda6"}]}]}}],"versions":["v13.1.0","v13.0.0","dashboards-v4.2.2","grid-v3.2.0","v13.0.2","v13.0.1","dashboards-v4.2.1","grid-v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116796.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N"}]}