HighVulnerabilityCVE-2026-118251updated 28 Oct 2026, 19:57 UTC

Highcharts charts can run hidden scripts when the credits link is clicked

If someone can control the chart's settings, a click on the small credits text can run attacker code inside your web page. That code can act as the logged-in user on that site.

Fix availableOfficial, 2 sources

Severity	HighCVSS 8.4 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes11.4.9, 12.6.1, 13.1.0 (or any later release); CDN versioned URLs such as code.highcharts.com/13.1.0/highcharts.js. Temporary workaround: a provided script that strips unsafe credits.href values before charts are created. · since 28 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1AttackerSupplies malicious chart configuration
2Chart builtUntrusted data reaches credits settings
3User clicksClicks the credits label on the page
4Script runsjavascript: URL executes in page origin
ResultAttacker runs script in the user's site session

What happened

Highcharts assigns credits.href to the window location on click without checking the URL scheme, so a javascript: URL executes script in the hosting page's origin. Affects Highcharts Core, Stock, Maps and Gantt.

Why it is dangerous: Attackers who can inject chart configuration can run script on the page, potentially stealing session data or performing actions as the user. Sites that build chart settings from untrusted input are most at risk.

Are you affected?

You are affected if you use the npm highcharts package versions below 11.4.9, 12.0.0 to below 12.6.1, or 13.0.0 to 13.0.2, including Highcharts Stock, Maps or Gantt, and chart configuration can contain untrusted data.

Package / product	Affected versions	Fixed in
highcharts · npm	< 11.4.9	11.4.9
highcharts · npm	>= 12.0.0, < 12.6.1	12.6.1
highcharts · npm	>= 13.0.0, <= 13.0.2	13.1.0

What to do

Upgrade highcharts to 11.4.9, 12.6.1, or 13.1.0 (for example: npm install highcharts@13.1.0)
If you cannot upgrade yet, add the vendor's workaround script after Highcharts loads and before any chart is created
Make sure chart configuration never includes untrusted or user-supplied values

Timeline

28 Oct 2026, 19:17 UTC
Publicly disclosed
28 Oct 2026, 19:17 UTC
Reported by NVD · NVD
28 Oct 2026, 19:17 UTC
Picked up by Zero Radar
28 Oct 2026, 19:57 UTC
GitHub Advisory reported on it · GitHub Advisory
28 Oct 2026, 19:57 UTC
Fixed version published: highcharts 11.4.9, highcharts 12.6.1, highcharts 13.1.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-118251NVD · 28 Oct 2026, 19:17 UTC
Highcharts: `javascript:` URL in credits.href runs script on clickGitHub Advisory · 28 Oct 2026, 19:56 UTC

Technical details

ID: CVE-2026-118251 · GHSA-5793-x2q3-c3q7
CVSS: 8.4 / 10
Disclosed: 28 Oct 2026, 19:17 UTC
On Zero Radar: 28 Oct 2026, 19:17 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 19:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works