Highcharts CVE-2026-116796

Exploitation requires a specific three-part chain stated by the vendor: (1) attacker-controlled untrusted data must reach a chart text option such as the title (via an SVG anchor using xlink:href with a javascript: URL); (2) the chart must be exported (including the default SVG download via the exporting module) or its container markup serialized so the XLink namespace is declared, and that output must be parsed again as a document (downloaded SVG opened in a browser, or exported/server-rendered markup inlined into a page); and (3) a user must activate (click) the link. The flaw does NOT trigger in the originally rendered live page, because there the attribute is written without the XLink namespace and browsers do not treat the anchor as a link - this is the key limiting factor. It is independent of whether useHTML is set. Applications that never place untrusted data into chart configuration, or never export/re-inline the SVG, are not exposed.

This is a stored/DOM XSS (CWE-79) in the Highcharts JS charting library where an SVG anchor's xlink:href attribute escapes the allowed-scheme filter that guards href and src, letting a javascript: URL survive into serialized/exported SVG output. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A, score 7.2) is internally consistent with the mechanism described: AT:P reflects that exploitation is not possible in the live rendered page (the attribute is written without the XLink namespace so browsers do not treat it as a link) and only becomes live after the chart is exported or server-rendered and that markup is parsed again; UI:A reflects that a user must activate the link; PR:L reflects that the attacker must be able to place untrusted data into a chart text option. There is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation is not indicated. A public reference containing the attack payload exists (the fix commit adds a unit test using '<a xlink:href="javascript:...">'), but there is no packaged weaponized exploit and no evidence of in-the-wild use. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a real but conditional client-side issue rather than a mass-exploitation emergency: it is a genuine patch-this-cycle item for anyone rendering attacker-influenced chart text and then exporting or re-inlining that SVG, but the multi-step precondition chain (attacker-controlled text + export/re-parse + user click) keeps real-world risk below what the 7.2 base score alone might suggest for environments that never expose untrusted chart configuration.

An application lets untrusted input populate a chart text option (such as the title) and then offers the chart's SVG as a download or inlines the server-rendered SVG into another page. The attacker supplies a title containing an SVG anchor whose xlink:href is a javascript: URL; this survives the text filter and is preserved verbatim in the exported SVG, which declares the XLink namespace. When a victim opens the downloaded SVG in a browser or views the page that inlined it and clicks the link, attacker script runs in that document's origin. The fix commit publicly includes a unit-test payload demonstrating the injection, though no standalone weaponized exploit is provided.