{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/highcharts-6.1.0---13.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:highcharts:highcharts:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-116796"},{"id":"CVE-2026-118244"},{"id":"CVE-2026-118249"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Highcharts (npm/highcharts 10.3.2 - 11.4.9)","Highcharts (npm/highcharts 12.0.0 - 12.6.2)","Highcharts (npm/highcharts 13.0.0 - 13.1.0)","Highcharts (npm/highcharts \u003e= 12.0.0, \u003c 12.6.1)","Highcharts (npm/highcharts \u003e= 13.0.0, \u003c= 13.0.2)","Highcharts (6.1.0 - 13.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Highcharts"],"content_html":"\u003cp\u003eHighcharts contains an XSS vulnerability (CVE-2026-116796) where the SVG exporting module fails to sanitize 'xlink:href' attributes in text options. The attribute is preserved in the serialized output of exported charts. If a user activates a link within an exported SVG opened in a browser or re-parsed in a downstream application, an attacker who controls the chart configuration can execute script in the origin of that document.\u003c/p\u003e\n","date_modified":"2026-10-29T12:28:11Z","date_published":"2026-10-29T00:17:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss-25b4a881/","summary":"Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.","title":"Highcharts: Cross-site scripting in exported SVG files (CVE-2026-116796)","url":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss-25b4a881/"}],"language":"en","title":"CraftedSignal Threat Feed - Highcharts (6.1.0 - 13.0.2)","version":"https://jsonfeed.org/version/1.1"}