Highcharts (Npm/Highcharts 10.3.2 - 11.4.9)

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.