Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118244— Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Quick assessment

Affected

highcharts highcharts

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Highcharts JS 是一款基于 SVG 的 JavaScript 图表库。在 12.0.0 至 12.6.1 以及 13.1.0 版本中，当 DOMParser 无法返回文档时，Highcharts 会在应用白名单之前，回退到将原始标记直接赋值给 innerHTML。在 Chromium 浏览器中，Trusted Types 回调可能在 beforeprint 处理器运行时抛出异常，因此，若在 beforeprint 期间重绘图表，攻击者便可将不受信任的 HTML 文本选项注入到宿主文档中。当打印开始时，这

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
highcharts	highcharts	`>= 12.0.0, < 12.6.1`	affected
		`>= 13.0.0, < 13.1.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Source: CVE Program / CVE List V5

Vulnerability Description

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
highcharts	highcharts	>= 12.0.0, < 12.6.1	-

II. Public POCs for CVE-2026-118244

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118244

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-118244 (1)

🔗 Core: HTML text parsing falls back to unfiltered `innerHTML` during printing · Advisory · highcharts/highcharts · GitHub Read full article x_refsource_CONFIRM

Other References for CVE-2026-118244 (2)

https://github.com/highcharts/highcharts/releases/tag/v13.1.0 x_refsource_MISC
https://github.com/highcharts/highcharts/commit/abde7c576793bf50b0e0636e59b49630de6dd0d5 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118244

Same Patch Batch · highcharts · 2026-10-28 · 16 CVEs total

CVE-2026-118245	8.6 HIGH	Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts names
CVE-2026-118254	8.6 HIGH	Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-116797	8.5 HIGH	Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118242	8.5 HIGH	Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>
CVE-2026-118246	8.4 HIGH	Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118253	8.4 HIGH	Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118251	8.4 HIGH	Highcharts: javascript: URL in credits.href runs script on click
CVE-2026-118252	8.4 HIGH	Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118255	8.4 HIGH	Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-116796	7.2 HIGH	Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering an
CVE-2026-118250	7.2 HIGH	Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-118249	7.2 HIGH	Highcharts: series column construction writes to Object.prototype
CVE-2026-118247	6.9 MEDIUM	Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__`
CVE-2026-118248	6.9 MEDIUM	Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118243	5.3 MEDIUM	Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototyp

IV. Related Vulnerabilities

Same product: highcharts

Same vendor: highcharts

Same weakness: CWE-79