Highcharts (6.1.0 - 13.0.2)

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.