Highcharts EUVD-2026-112307

Four concrete prerequisites, all stated by the vendor advisory, must hold together: (1) untrusted/attacker-influenced data must reach an HTML-rendered chart text option - useHTML titles, axis labels, data labels, or text set by responsive rules (Stock, Maps, and Gantt are included as they ship from the same package); (2) the hosting page must re-render/update the chart from a beforeprint event handler; (3) the browser must be Chromium, where the Trusted Types policy callback throws while beforeprint runs, forcing the unfiltered innerHTML fallback before the allow-list is applied; and (4) printing must actually be initiated - the exporting menu's print item triggers this on its own. These conditions (reflected as AT:P and UI:A) substantially limit exploitation: a non-Chromium browser, a page that does not re-render on beforeprint, or configurations without untrusted data in chart text options are not affected. Affected versions are 12.0.0 through <12.6.1 and 13.0.0 through 13.0.2; the only complete fix stated by the vendor is upgrading to 12.6.1 or 13.1.0, with an IIFE parseMarkup override offered as a drop-in workaround for all affected versions.

This is a genuine but conditional client-side XSS (CWE-79) in a very widely deployed charting library, best treated as an important rather than emergency fix - consistent with the input's 'this_week' decision label, not act_now/emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A, VC:H/VI:H) scores 7.2 High, but the AT:P (attack requirement) and UI:A (active user interaction) metrics correctly reflect strong real-world constraints: exploitation is confirmed by the vendor advisory to require a specific chain - untrusted data reaching HTML text options, the hosting page re-rendering the chart from a beforeprint handler, a Chromium browser where the Trusted Types callback throws, and the user actually initiating printing. No CISA KEV listing and no EPSS score are present in the input, so there is no signal of active or widespread exploitation; this is 'no public exploit identified as active exploitation.' A public PoC reference exists (the vendor's jsfiddle 'Live demo & testing' link and a regression test using '<img onerror>' markup), but it is not verified as working weaponized exploit code. Net: a legitimate priority for teams that embed untrusted data in Highcharts titles/labels and re-render on beforeprint, but the combination of required conditions makes mass, opportunistic exploitation unlikely. The DOMParser fallback detail (AT:P) is directly stated in the advisory and commit, so the mechanism is well-evidenced rather than inferred.

An attacker gets untrusted content (e.g. a user-controlled chart title, data label, or responsive text option) into a Highcharts configuration on a page that re-renders the chart from a beforeprint handler in Chromium. When a victim starts printing - which the exporting menu's print item does on its own - the Trusted Types callback throws, the parser falls back to assigning raw markup to innerHTML before the allow-list runs, and embedded event handlers execute in the hosting page's origin. A public PoC reference (vendor jsfiddle demo) exists but is not verified as working exploit code.