Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118251— Highcharts: javascript: URL in credits.href runs script on click

Quick assessment

Affected

highcharts highcharts

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Highcharts JS 是一款基于 SVG 的 JavaScript 图表库。在 11.4.9、12.6.1 和 13.1.0 版本之前，当用户点击版权标签（credits label）时，Highcharts 会将 credits.href 属性设置为当前窗口的地址，且未将目标 URL 与允许的协议列表（allowed-scheme list）进行校验。若攻击者能够控制图表配置，即可注入 javascript 协议开头的 URL；当用户点击版权标签时，攻击脚本将在托管页面的同源环境中执行。Highcharts

CVSS 8.4 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
highcharts	highcharts	`< 11.4.9`	affected
		`>= 12.0.0, < 12.6.1`	affected
		`>= 13.0.0, < 13.1.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Highcharts: javascript: URL in credits.href runs script on click

Source: CVE Program / CVE List V5

Vulnerability Description

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
highcharts	highcharts	< 11.4.9	-

II. Public POCs for CVE-2026-118251

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118251

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118251 (2)

Vendor Advisories for CVE-2026-118251 (1)

🔗 Core: javascript: URL in credits.href runs script on click · Advisory · highcharts/highcharts · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-118251 (1)

🔗 Release v13.1.0 · highcharts/highcharts · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118251

Same Patch Batch · highcharts · 2026-10-28 · 16 CVEs total

CVE-2026-118245	8.6 HIGH	Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts names
CVE-2026-118254	8.6 HIGH	Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-116797	8.5 HIGH	Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118242	8.5 HIGH	Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>
CVE-2026-118246	8.4 HIGH	Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118253	8.4 HIGH	Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118252	8.4 HIGH	Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118255	8.4 HIGH	Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-116796	7.2 HIGH	Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering an
CVE-2026-118244	7.2 HIGH	Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during
CVE-2026-118250	7.2 HIGH	Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-118249	7.2 HIGH	Highcharts: series column construction writes to Object.prototype
CVE-2026-118247	6.9 MEDIUM	Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__`
CVE-2026-118248	6.9 MEDIUM	Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118243	5.3 MEDIUM	Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototyp

IV. Related Vulnerabilities

Same product: highcharts

Same vendor: highcharts

Same weakness: CWE-79