# CVE-2026-116796: Highcharts JS unfiltered xlink:href in exported SVG

Source: https://junglewise.ai/threats/cve-2026-116796-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116796 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts is a JavaScript charting library used to create interactive graphs and charts in web applications. An attacker who controls chart text content can inject malicious links that execute JavaScript when a user clicks them in exported or server-rendered SVG output. This could lead to account compromise or data theft if the exported chart is viewed in a trusted origin.

Technologies: [Highcharts JS](https://junglewise.ai/threats/technologies/highcharts-highcharts-js), [highcharts (npm)](https://junglewise.ai/threats/technologies/highcharts). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116796 being exploited in the wild.

**How severe is CVE-2026-116796?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts JS 10.3.2 to 11.4.8, 12.0.0 to 12.6.1, 13.0.0 to 13.1.0; highcharts (npm) >= 10.3.2, < 11.4.9, SEMVER:introduced=10.3.2,fixed=11.4.9.

**Is there a fix for CVE-2026-116796?** Yes. highcharts (npm): upgrade to 11.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116796 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116796?** Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- highcharts (npm): upgrade to 11.4.9 or later

  ```sh
  npm install highcharts@11.4.9
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in SVG rendering where xlink:href attributes on anchor elements bypass the allowed-scheme validation that is applied to href and src attributes. An attacker can inject a javascript: URL in chart text options; when the chart is exported to SVG and parsed again, clicking the link executes the malicious script in the document's origin. User interaction (clicking the link) is required to trigger the exploit.

## Affected products

- Highcharts Highcharts JS 10.3.2 to 11.4.8, 12.0.0 to 12.6.1, 13.0.0 to 13.1.0

## Identifiers

- CVE-2026-116796
- GHSA-mw4f-gj5x-6xr4

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88](https://github.com/highcharts/highcharts/commit/6cf359fb144aa51fdc105e2b9bbd013439b02c88)
- [https://github.com/highcharts/highcharts/releases/tag/v13.1.1](https://github.com/highcharts/highcharts/releases/tag/v13.1.1)

## Related threats

- [Highcharts JavaScript library cross-site scripting in credits link](https://junglewise.ai/threats/cve-2026-118251-highcharts-js-is-a-javascript-charting-library-based-on-svg)
- [Highcharts JS prototype pollution via dotted series keys](https://junglewise.ai/threats/cve-2026-118250-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS prototype pollution in series data](https://junglewise.ai/threats/cve-2026-118249-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JavaScript event handler injection via breadcrumbs](https://junglewise.ai/threats/cve-2026-118246-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS cross-site scripting via innerHTML fallback on print](https://junglewise.ai/threats/cve-2026-118244-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)