Is CVE-2026-118244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118244 being exploited in the wild.

How severe is CVE-2026-118244?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts Gantt 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts JS 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts Maps 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts Stock 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; and 1 more.

Is there a fix for CVE-2026-118244?

Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118244 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118244?

Check whether you run Highcharts Gantt, Highcharts JS, Highcharts Maps or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118244: Highcharts JS cross-site scripting via innerHTML fallback on print

CVE-2026-118244 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts is a JavaScript charting library used to create interactive data visualizations on web pages. When printing a page containing a Highcharts chart, malicious HTML can be injected and executed in the page's origin if the browser's DOMParser fails. An attacker who can control chart content (titles, labels, or data labels) can execute arbitrary JavaScript in the user's browser, leading to account takeover or data theft.

Technologies: Highcharts JS, highcharts (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-118244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118244 being exploited in the wild.
How severe is CVE-2026-118244?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts Gantt 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts JS 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts Maps 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; Highcharts Stock 12.0.0 to 12.6.0, 13.0.0 to 13.0.2; and 1 more.
Is there a fix for CVE-2026-118244?: Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118244 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118244?: Check whether you run Highcharts Gantt, Highcharts JS, Highcharts Maps or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

highcharts (npm): upgrade to 12.6.1 or later
```
npm install highcharts@12.6.1
```

Technical details

The vulnerability occurs when Highcharts falls back to assigning raw markup to innerHTML without applying its allow-list if DOMParser cannot return a document. In Chromium, the Trusted Types callback can throw during a beforeprint handler, allowing a page that redraws a chart during printing to insert unsanitized HTML. This bypasses content sanitization and permits event handler execution in the page origin. The flaw affects HTML-rendered titles, labels, data labels, responsive text, and Stock, Maps, and Gantt products.

Affected products

Highcharts Highcharts JS 12.0.0 to 12.6.0, 13.0.0 to 13.0.2
Highcharts Highcharts Stock 12.0.0 to 12.6.0, 13.0.0 to 13.0.2
Highcharts Highcharts Maps 12.0.0 to 12.6.0, 13.0.0 to 13.0.2
Highcharts Highcharts Gantt 12.0.0 to 12.6.0, 13.0.0 to 13.0.2

Identifiers

CVE-2026-118244
GHSA-65hg-cf3f-5m39

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.