Highcharts (Npm/Highcharts >= 13.0.0, <= 13.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/highcharts-npm/highcharts--13.0.0--13.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 00:17:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHighcharts: Cross-site scripting in exported SVG files (CVE-2026-116796)https://feed.craftedsignal.io/briefs/2026-10-highcharts-xss-25b4a881/Thu, 29 Oct 2026 00:17:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-highcharts-xss-25b4a881/Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.<p>Highcharts contains an XSS vulnerability (CVE-2026-116796) where the SVG exporting module fails to sanitize 'xlink:href' attributes in text options. The attribute is preserved in the serialized output of exported charts. If a user activates a link within an exported SVG opened in a browser or re-parsed in a downstream application, an attacker who controls the chart configuration can execute script in the origin of that document.</p> highadvisory