# Highcharts cross-site scripting in href sanitization

Source: https://junglewise.ai/threats/highcharts-cross-site-scripting-in-href-sanitization-7367af5b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2020-08-25

Highcharts is a popular JavaScript charting library used to create interactive data visualizations on websites. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into charts if unsanitized user input (such as chart titles, labels, or links) is used in chart configuration. An attacker could craft a malicious link that, when clicked by a user viewing a chart, executes arbitrary JavaScript in their browser, potentially stealing session data, account credentials, or other sensitive information.

Technologies: [highcharts (npm)](https://junglewise.ai/threats/technologies/highcharts). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 25 August 2020.

**Which products and versions are affected?** highcharts (npm) SEMVER:introduced=0,fixed=7.2.2.

**Is there a fix for This vulnerability?** Yes. highcharts (npm): upgrade to 7.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- highcharts (npm): upgrade to 7.2.2 or later

  ```sh
  npm install highcharts@7.2.2
  ```


## Technical details

The vulnerability is a stored/reflected XSS (CWE-79) in Highcharts' handling of `<a>` tags within chart configuration. The library fails to properly sanitize href attributes and does not restrict URL schemes, converting `<a>` tags to `<tspan>` elements with onclick handlers. An attacker can inject arbitrary JavaScript URLs (using javascript: scheme or event handlers) through chart configuration properties such as titles, subtitles, labels, or tooltips. The vulnerability affects versions prior to 7.2.2 and 8.0.0–8.1.0. The root cause is insufficient input validation on URLs and attributes during DOM rendering. The vulnerability has been fixed in versions 7.2.2 and 8.1.1 via commit 55c39dd, which properly sanitizes URL schemes and href values.

## Affected products

- Highcharts Highcharts before 7.2.2, 8.0.0 to before 8.1.1

## Timeline

- 2020-05-20: disclosed: Vulnerability reported on GitHub issue #13559
- 2020-05-20: patched: Fix committed (55c39dd) same day
- 2020-08-25: advisory: GHSA-gr4j-r575-g665 published

## References

- [https://github.com/highcharts/highcharts/issues/13559](https://github.com/highcharts/highcharts/issues/13559)
- [https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5](https://github.com/highcharts/highcharts/commit/55c39dd55f12ce8dfab84f8ec13ad81423bee9f5)

## Related threats

- [Highcharts JavaScript library cross-site scripting in credits link](https://junglewise.ai/threats/cve-2026-118251-highcharts-js-is-a-javascript-charting-library-based-on-svg)
- [Highcharts JS prototype pollution via dotted series keys](https://junglewise.ai/threats/cve-2026-118250-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS prototype pollution in series data](https://junglewise.ai/threats/cve-2026-118249-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JavaScript event handler injection via breadcrumbs](https://junglewise.ai/threats/cve-2026-118246-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS cross-site scripting via innerHTML fallback on print](https://junglewise.ai/threats/cve-2026-118244-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)