CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...