Highcharts JS: Cross-site scripting via breadcrumb style attributes
Summary
Highcharts JS, a JavaScript charting library, applies the breadcrumbs.style option as SVG attributes without filtering the attribute names. An attacker who can control chart configuration can add event-handler attributes that run JavaScript in the origin of the hosting page once a user navigates to a drilldown level and activates a breadcrumb button. Styled-mode charts are not affected.
Affected
- Highcharts JS 10.0.0 up to but excluding 11.4.9
- Highcharts JS 12.0.0 up to but excluding 12.6.1
- Highcharts JS 13.0.0 up to but excluding 13.1.0
- Note: the CNA record lists the 13.x range as ending at 13.1.1; verify on the GHSA page.
Fixed in
- 11.4.9
- 12.6.1
- 13.1.0
Workaround
- No workaround is documented by the vendor. Upgrading is the fix.
- Charts rendered in styled mode are not affected, but switching modes is a code change and must be tested first.
Exploitation
- No public proof of concept found in the sources reviewed.
- No evidence of exploitation in the wild; not listed in CISA KEV as of this check.
- Exploitation requires that untrusted data reach the chart configuration and that a user drill down and interact with the breadcrumb button.
Our recommendation
- Inventory all applications that use Highcharts JS (npm lockfiles, CDN URLs, wrapper products).
- Upgrade to 11.4.9, 12.6.1 or 13.1.0 within the same major line.
- Restrict who can supply chart configuration and validate user-supplied chart options server-side.
- Apply a strict Content Security Policy to limit the impact of script execution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-35rr-xwfh-x789 github.com
- Fix commit b0fafda (Highcharts) github.com
- Highcharts release v13.1.0 github.com
- OSV entry CVE-2026-118246 osv.dev
- GitLab Advisory Database entry (npm/highcharts) advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:56.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.