Highcharts (Npm/Highcharts >= 12.0.0, < 12.6.1)

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.