Zero Radar
← feed
HighVulnerabilityCVE-2026-118244updated 28 Oct 2026, 19:55 UTC

Highcharts can run injected scripts when charts are printed in Chromium

If a web page builds charts from data a user or attacker can influence, that data can carry hidden scripts. In Chromium browsers, those scripts can run when the user prints the chart.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes12.6.1 (for the 12.x line); 13.1.0 (for the 13.x line) · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Injects markupMalicious text placed in chart data or config
  2. 2User opens pageChromium browser loads the chart
  3. 3User printsPrint starts, beforeprint handler redraws chart
  4. 4Unsafe parsingTrusted Types throws, raw HTML inserted
  5. 5Script runsEvent handler executes in page origin
  6. ResultAttacker script runs in the page origin

What happened

Highcharts parses HTML text options (titles, labels, data labels, responsive text) and falls back to raw innerHTML when DOMParser fails. In Chromium, a Trusted Types callback throws during a beforeprint handler, so a chart redrawn at that moment inserts unsanitized markup, letting event handlers run in the page origin.

Why it is dangerous: An attacker who can inject text into chart configuration can run script in the page's origin, potentially reading or acting on the user's session. Pages that redraw charts in a beforeprint handler are the main exposure.

Are you affected?

You are affected if you use Highcharts (Core, Stock, Maps or Gantt) npm versions 12.0.0 through 12.6.0, or 13.0.0 through 13.0.2, with HTML-rendered chart text, untrusted data in the chart configuration, and a beforeprint handler that updates the chart.

Package / productAffected versionsFixed in
highcharts · npm>= 12.0.0, < 12.6.112.6.1
highcharts · npm>= 13.0.0, <= 13.0.213.1.0

What to do

  1. Update highcharts to 12.6.1 (12.x) or 13.1.0 (13.x), for example npm install highcharts@13.1.0
  2. If you cannot update yet, add the vendor-provided workaround script that runs after Highcharts loads, as shown in the advisory
  3. Ensure untrusted data never reaches chart titles, labels or text options without sanitizing it first

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:55 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:55 UTC
    Fixed version published: highcharts 12.6.1, highcharts 13.1.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118244 · GHSA-65hg-cf3f-5m39
CVSS
7.2 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:55 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts can run injected scripts when charts are printed in Chromium · Zero Radar