Highcharts (Npm/Highcharts 12.0.0 - 12.6.2)

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.