Highcharts Core: Breadcrumbs style attribute cross-site scripting (CVE-2026-118246)

Highcharts Core versions 10.0.0 through 13.0.2 are affected by a cross-site scripting (XSS) vulnerability identified as CVE-2026-118246. The breadcrumbs.style configuration option fails to sanitize keys before applying them as SVG attributes. An attacker capable of influencing the chart configuration can inject event-handler attributes, such as onmouseover, which the browser will execute in the context of the origin hosting the chart when the breadcrumb component is rendered and interacted with by a user. This flaw affects Highcharts Core, Highcharts Stock, Highcharts Maps, and Highcharts Gantt. Charts utilizing "styled mode" are not affected.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the user's browser session. This can be used to hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the user within the vulnerable application origin.

Recommendation

• Upgrade Highcharts to the patched versions: 11.4.9, 12.6.1, or 13.1.0 or later.
• If upgrading is not immediately feasible, apply the provided JavaScript workaround by injecting the following snippet after loading the Highcharts library but before any chart initialization: ((H)=>{const S=H.SVGElement.prototype,D=S._defaultSetter;S._defaultSetter=function _defaultSetter(v,k,e){/^on/i.test(k)||D.call(this,v,k,e)};})(Highcharts);
• Audit applications that pass user-supplied or external JSON configuration objects to Highcharts to ensure the breadcrumbs configuration object is strictly validated against a known-safe schema.