Highcharts JS CVE-2026-118246

Requires ALL of the following: (1) the Highcharts chart must be rendered in non-styled mode - styled-mode charts do not apply the breadcrumbs.style option and are not affected; (2) untrusted/attacker-controlled data must reach the chart configuration, specifically an event-handler-named key (e.g., onmouseover) under breadcrumbs.style, reachable via drilldown.breadcrumbs, navigation.breadcrumbs, or the breadcrumbs option of the treemap, sunburst or treegraph series; (3) a victim user must drill down or traverse into a hierarchical-series level so the breadcrumb button actually renders; and (4) the victim must then hover over or activate that breadcrumb button to fire the handler. Affected versions are >=10.0.0 and < 11.4.9, >=12.0.0 and < 12.6.1, and >=13.0.0 through 13.0.2; this applies across Highcharts Core, Stock, Maps and Gantt since they ship from the same package. The requirement for config control plus specific victim interaction (UI:A) are the primary limiting factors on real-world exploitation.

This is a genuine, actionable client-side XSS (CWE-79) in a very widely deployed charting library, but its risk is gated by several real preconditions rather than being a drive-by remote flaw. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A, VC:H/VI:H) scores 8.4 and already encodes the two key limiters: PR:L means the attacker must be able to get untrusted data into the chart configuration (so some privilege or a data-injection path is required - not fully anonymous), and UI:A means a victim must actively navigate a drilldown/hierarchical level and then hover over or activate the breadcrumb button for the planted handler to fire. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no signal of active or widespread exploitation; the vuln.today 'this_week' decision label marks it as a prioritized-but-not-emergency fix. A proof-of-concept does exist in the form of the vendor's own unit test (the fix commit demonstrates style: { onmouseover: 'window.breadcrumbsPwned = true' }), confirming the mechanism is real and trivially reproducible once untrusted data reaches the config. Net: treat as a real priority for any deployment that renders attacker-influenced data in Highcharts drilldown/hierarchical charts in non-styled mode, but it is not a mass-exploitable unauthenticated RCE-class issue - the requirement for config control plus victim interaction keeps it below emergency tier.

An attacker submits untrusted data (e.g., a chart label, series name, or dataset field) into an application that feeds it into a Highcharts drilldown or hierarchical-series breadcrumbs configuration, including an event-handler key such as onmouseover under breadcrumbs.style. When a victim user drills down (or traverses into a treemap/sunburst/treegraph level) so the breadcrumb button renders and then hovers over or clicks it, the attacker's JavaScript executes in the origin of the hosting page. A working proof-of-concept exists as the vendor's unit test demonstrating the onmouseover payload; because UI:A applies, exploitation still depends on the victim interacting with the breadcrumb.