{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahighchartshighcharts/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:highcharts:highcharts:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-118246"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Highcharts Core (\u003e= 10.0.0, \u003c 11.4.9)","Highcharts Core (\u003e= 12.0.0, \u003c 12.6.1)","Highcharts Core (\u003e= 13.0.0, \u003c= 13.0.2)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","client-side-injection"],"_cs_type":"advisory","_cs_vendors":["Highcharts"],"content_html":"\u003cp\u003eHighcharts Core versions 10.0.0 through 13.0.2 are affected by a cross-site scripting (XSS) vulnerability identified as CVE-2026-118246. The \u003ccode\u003ebreadcrumbs.style\u003c/code\u003e configuration option fails to sanitize keys before applying them as SVG attributes. An attacker capable of influencing the chart configuration can inject event-handler attributes, such as \u003ccode\u003eonmouseover\u003c/code\u003e, which the browser will execute in the context of the origin hosting the chart when the breadcrumb component is rendered and interacted with by a user. This flaw affects Highcharts Core, Highcharts Stock, Highcharts Maps, and Highcharts Gantt. Charts utilizing \u0026quot;styled mode\u0026quot; are not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to arbitrary JavaScript execution in the user's browser session. This can be used to hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the user within the vulnerable application origin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Highcharts to the patched versions: 11.4.9, 12.6.1, or 13.1.0 or later.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, apply the provided JavaScript workaround by injecting the following snippet after loading the Highcharts library but before any chart initialization:\n\u003ccode\u003e((H)=\u0026gt;{const S=H.SVGElement.prototype,D=S._defaultSetter;S._defaultSetter=function _defaultSetter(v,k,e){/^on/i.test(k)||D.call(this,v,k,e)};})(Highcharts);\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAudit applications that pass user-supplied or external JSON configuration objects to Highcharts to ensure the \u003ccode\u003ebreadcrumbs\u003c/code\u003e configuration object is strictly validated against a known-safe schema.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:16:40Z","date_published":"2026-10-29T00:16:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss/","summary":"A cross-site scripting (XSS) vulnerability in Highcharts Core allows arbitrary JavaScript execution when an attacker-controlled chart configuration injects event-handler attributes into SVG breadcrumb elements.","title":"Highcharts Core: Breadcrumbs style attribute cross-site scripting (CVE-2026-118246)","url":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:highcharts:highcharts:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}