GHSA-MW4F-GJ5X-6XR4 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Impact The filter applied to markup in text options checks href, src and a few similar attributes against an allowed-scheme list, but accepts xlink:href without that check, so an SVG anchor whose xlink:href is a javascript: URL passes the filter, whether or not the option is rendered with useHTML...

npm: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

npm: Highcharts Core: javascript: URL in an xlink:href attribute survives text filtering and reaches exported charts vulnerability discovered by ? in WordPress npm highcharts versions = 10.3.2, 11.4.9...