CLEANSTART-2024-DH07611 HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes

Security vulnerability affects the librewolf package. The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes...

CLEANSTART-2024-XV41479 HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes

Security vulnerability affects the firefox package. The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes...

Linux Distros Unpatched Vulnerability : CVE-2026-116796

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute...

RHEL 6 : python-lxml (RHSA-2026:90336)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90336 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

npm: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

npm: Highcharts Core: javascript: URL in an xlink:href attribute survives text filtering and reaches exported charts vulnerability discovered by ? in WordPress npm highcharts versions = 10.3.2, 11.4.9...

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Impact The filter applied to markup in text options checks href, src and a few similar attributes against an allowed-scheme list, but accepts xlink:href without that check, so an SVG anchor whose xlink:href is a javascript: URL passes the filter, whether or not the option is rendered with useHTML...

GHSA-MW4F-GJ5X-6XR4 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Impact The filter applied to markup in text options checks href, src and a few similar attributes against an allowed-scheme list, but accepts xlink:href without that check, so an SVG anchor whose xlink:href is a javascript: URL passes the filter, whether or not the option is rendered with useHTML...

Cross-site Scripting (XSS)

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the xlink:href attribute being unfiltered in exported SVG output. The AST.ts sanitizer omits...

CVE-2026-116796

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

EUVD-2026-112279

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796

The Highcharts JS charting library (versions 10.3.2 through 11.4.9, 12.6.2, and 13.1.1) is vulnerable to a Cross-Site Scripting (XSS) flaw. The library fails to apply allowed-scheme checks to the xlink:href attribute of SVG anchors, even though it applies them to href and src attributes. An attac...

CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

PT-2026-128346

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

Highcharts cross-site scripting vulnerability

Highcharts versions 10.3.2 through 11.4.9, 12.0.0 through 12.6.2, and 13.0.0 through 13.1.1 contain a cross-site scripting vulnerability. This vulnerability arises from the failure to perform href and src scheme validation when processing SVG anchor xlink:href attributes. As a result, attackers c...

CVE-2026-116796: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...