Is CVE-2026-116796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116796 being exploited in the wild.

How severe is CVE-2026-116796?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts JS 10.3.2 to 11.4.8, 12.0.0 to 12.6.1, 13.0.0 to 13.1.0; highcharts (npm) >= 10.3.2, < 11.4.9, SEMVER:introduced=10.3.2,fixed=11.4.9.

Is there a fix for CVE-2026-116796?

Yes. highcharts (npm): upgrade to 11.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116796 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116796?

Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116796: Highcharts JS unfiltered xlink:href in exported SVG

Q: Is there a fix for CVE-2026-116796?

Yes. highcharts (npm): upgrade to 11.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116796 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-116796?

Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116796 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts is a JavaScript charting library used to create interactive graphs and charts in web applications. An attacker who controls chart text content can inject malicious links that execute JavaScript when a user clicks them in exported or server-rendered SVG output. This could lead to account compromise or data theft if the exported chart is viewed in a trusted origin.

Technologies: Highcharts JS, highcharts (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-116796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116796 being exploited in the wild.
How severe is CVE-2026-116796?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts JS 10.3.2 to 11.4.8, 12.0.0 to 12.6.1, 13.0.0 to 13.1.0; highcharts (npm) >= 10.3.2, < 11.4.9, SEMVER:introduced=10.3.2,fixed=11.4.9.
Is there a fix for CVE-2026-116796?: Yes. highcharts (npm): upgrade to 11.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116796 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116796?: Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

highcharts (npm): upgrade to 11.4.9 or later
```
npm install highcharts@11.4.9
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in SVG rendering where xlink:href attributes on anchor elements bypass the allowed-scheme validation that is applied to href and src attributes. An attacker can inject a javascript: URL in chart text options; when the chart is exported to SVG and parsed again, clicking the link executes the malicious script in the document's origin. User interaction (clicking the link) is required to trigger the exploit.

Affected products

Highcharts Highcharts JS 10.3.2 to 11.4.8, 12.0.0 to 12.6.1, 13.0.0 to 13.1.0

Identifiers

CVE-2026-116796
GHSA-mw4f-gj5x-6xr4

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.