GHSA-35RR-XWFH-X789 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Impact The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live...

CVE-2026-118246

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246

The Highcharts JS library (versions 10.0.0 through 11.4.9 , 12.6.1 , and 13.1.0 ) is vulnerable to a Cross-Site Scripting (XSS) flaw because it applies breadcrumbs.style as SVG attributes without filtering attribute names. An attacker who can control the chart configuration can inject event-handl...

EUVD-2026-112309

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

PT-2026-129093

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...