Highcharts (Npm/Highcharts >= 13.0.0, <= 13.0.2)

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.