Highcharts: Cross-site scripting in exported SVG files (CVE-2026-116796)
Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.
CVE search metadata
CVE search record: CVE-2026-116796. KEV: no. Product: Highcharts (npm/highcharts 10.3.2 - 11.4.9), Highcharts (npm/highcharts 12.0.0 - 12.6.2), Highcharts (npm/highcharts 13.0.0 - 13.1.0). Brief: Highcharts: Cross-site scripting in exported SVG files (CVE-2026-116796). Brief link: https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss-25b4a881/
Triage facts
Revision 1- Applicability
- Highcharts (npm/highcharts 10.3.2 - 11.4.9), Highcharts (npm/highcharts 12.0.0 - 12.6.2) +1
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 00:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
Highcharts contains an XSS vulnerability (CVE-2026-116796) where the SVG exporting module fails to sanitize 'xlink:href' attributes in text options. The attribute is preserved in the serialized output of exported charts. If a user activates a link within an exported SVG opened in a browser or re-parsed in a downstream application, an attacker who controls the chart configuration can execute script in the origin of that document.